Baza znanja

Modern applications rely on hundreds of third-party packages, any of which could contain a known vulnerability. This guide covers auditing and securing dependencies across npm, pip, and Composer.

Why Dependency Auditing Matters

A vulnerability in a deeply nested dependency you've never directly interacted with can still fully compromise your application — regular auditing catches these before attackers exploit them.

Node.js: npm audit

npm audit

This reports known vulnerabilities in your installed packages, categorized by severity.

Automatically fix issues where a safe non-breaking update exists:

npm audit fix

For fixes that require breaking changes (review carefully before running):

npm audit fix --force

Python: pip-audit

pip install pip-audit
pip-audit

Reports known CVEs affecting your installed package versions.

PHP: Composer Audit

composer audit

Built into modern Composer versions — checks installed packages against known security advisories.

Checking for Outdated Packages

Node.js:

npm outdated

Python:

pip list --outdated

PHP:

composer outdated

Setting Up Automated Dependency Scanning

Many source control platforms (GitHub, GitLab) offer built-in automated dependency vulnerability alerts and can auto-generate update pull requests — enabling this catches issues continuously rather than only when you remember to run a manual audit.

Reviewing Before Auto-Updating

Always test after running any automated fix command, especially --force variants that may introduce breaking API changes:

npm audit fix
npm test

Pinning Dependency Versions for Reproducibility

Always commit lock files to version control:

• Node.js: package-lock.json
• Python: use pip freeze > requirements.txt, or better, a tool like Poetry with its own lock file
• PHP: composer.lock

Lock files ensure every environment (development, staging, production) installs the exact same dependency tree, preventing "works on my machine" surprises.

Removing Unused Dependencies

Fewer dependencies means a smaller attack surface. Periodically review and remove packages no longer actually used by the application.

Reviewing Before Adding a New Dependency

• Check the package's maintenance activity and last update date
• Review download counts/popularity as a rough trust signal
• Consider whether the functionality is simple enough to implement directly instead of adding a new dependency

Common Errors

"npm audit fix" breaks the application — a fix updated a package to a version with breaking API changes; review the specific package's changelog and update your code accordingly, or pin to a specific safe version manually.

Best Practices

• Run dependency audits regularly, not just once at project start
• Enable automated scanning through your source control platform where available
• Always commit lock files for reproducible installs
• Test thoroughly after any dependency update, especially security-driven ones

Related Articles

• How to Install Composer for PHP Dependency Management
• How to Install Node.js on Ubuntu & Debian (with NVM)
• VPS Security Checklist for Beginners