Add a Dependency Lockfile Audit

Audit the committed lockfile for known vulnerabilities, fail CI on high severity, and remediate through version updates rather than blanket overrides.

~25 minsecuritysupply-chainci-cd

Task

Prevent a vulnerable transitive dependency from reaching production without a reviewed update path.

When to use this

A security advisory is published for a package three levels deep in the dependency tree. The team does not know which services are affected or which version fixes it.

Prerequisites

A committed lockfile used by CI
A package manager with an audit command
A policy for severity thresholds and exception expiry

Steps

1. Run the audit against production dependencies with the same lockfile CI uses.

pnpm audit --prod --audit-level high

Expected output: The command reports high and critical advisories with the affected dependency paths.

2. Trace each advisory to the package that introduced it and choose a direct dependency update or a targeted override.

pnpm why VULNERABLE_PACKAGE

Expected output: The owner of the transitive dependency and the available fixed version are visible.

3. Update the dependency or lockfile, rerun the audit, and run the test suite before merging.

pnpm update PACKAGE && pnpm audit --prod --audit-level high && pnpm test

Expected output: The advisory is resolved and the application tests still pass.

Troubleshooting

Problem

No fixed version exists

Solution

Assess reachability and severity, document a time-bound exception with an owner, or replace/remove the dependency.

Problem

The audit is noisy with dev-only findings

Solution

Audit production dependencies separately and keep dev tooling findings in a different, still-reviewable track.

Limitations

An audit database can lag or contain false positives; verify the advisory and the affected version range.
Updating a transitive dependency can change behavior; review the lockfile diff and run integration tests.

Audit the artifact you ship

An audit is only meaningful against the lockfile that produced the build. Running it in a developer environment with a different resolution can miss or invent findings. Commit the lockfile, use frozen installs in CI, and audit production dependencies as a required check.

pnpm install --frozen-lockfile
pnpm audit --prod --audit-level high
pnpm why vulnerable-package

Remediate with evidence

Find the direct dependency that introduced the vulnerable package. Prefer updating the direct dependency to a version that pulls a fixed transitive version. If no fix exists, assess whether the vulnerable code path is reachable, document a time-bound exception with an owner, and consider replacing the package. Blanket overrides can break unrelated consumers.

Keep the gate credible

Fail on high and critical findings, but keep a documented exception list with expiry dates. A gate that fails on hundreds of low-severity or dev-only findings will be bypassed. Review the lockfile diff in the pull request, run the tests, and verify the fixed version is actually present in the final artifact.