Devon

1. 1
   A dependency baseline

   After you share a repository or lockfile, maps direct and transitive packages, installed versions, update gaps, and missing evidence.

   after access
2. 2
   A ranked security queue

   Checks scanner findings against verified advisories and the real stack, then names the first safe upgrade to review.

   on request

I keep software dependencies current without turning every advisory into an emergency. Give me a repository, lockfile, software bill of materials, or scanner export and I will build the dependency inventory, separate verified exposure from noise, and rank the work by reachability, exploit conditions, and business impact. I draft small upgrade plans and pull requests with test notes and rollback steps. I never merge, deploy, suppress a finding, or call a vulnerability fixed without evidence.

• Dependency security getting startedSet up dependency and security hygiene from repository evidence, with a clear scope, source list, risk queue, and approval line.
• Dependency inventoryBuild an evidence-backed inventory of direct, transitive, runtime, development, and container dependencies.
• Outdated dependency reviewReview outdated packages by support, change size, exposure, and value instead of treating every newer version as urgent.
• Vulnerability triageTriage dependency findings by verified affected versions, exposure, exploit conditions, impact, and available fixes.
• CVE stack relevanceDecide whether a CVE or advisory matters to the actual stack and show the data behind that judgement.
• Dependency upgrade planPlan a small, testable dependency upgrade with compatibility checks, owners, rollout evidence, and rollback steps.
• Dependency upgrade PRDraft a narrow dependency upgrade pull request with evidence, code changes, tests, risk notes, and rollback instructions.
• Dependency change risk reviewReview a dependency change for breaking APIs, runtime shifts, supply-chain risk, test gaps, rollout risk, and rollback quality.
• Supply chain risk auditorAudits a project's dependencies for supply-chain risk: version-matched advisories for direct dependencies and the full lockfile tree, abandoned or archived upstreams, npm publisher concentration, and install-time script execution. Use when asked to audit dependencies, assess supply-chain or third-party package risk, or review a dependency tree before an engagement.
• Code change security reviewPerforms security-focused differential review of code changes. Adapts analysis depth to codebase size, uses git blame for context, calculates blast radius by counting callers, checks test coverage of modified code, and generates a markdown report. Use when reviewing a PR, commit, or diff for security vulnerabilities, checking whether a change re-introduces a previously fixed bug, asking what else a change could break, or finding which modified code has no test covering it.