dependency-review

AUR package update vetting tool. Run it before yay -Syu.

A dependency-decision ledger for Node.js & coding agents — every dependency recorded, explained, and reviewable in the PR. Zero runtime deps.

Hands-on study guide for the GH-500: GitHub Advanced Security certification. Covers all 5 exam domains with docs, demos, CodeQL, Dependabot config, and automation scripts.

GitHub Actions GH-500 Certification Study Guide: Complete and up-to-date guide for the GitHub Advanced Security (GHAS) Certification GH-500 Exam. Includes all domains, key concepts, configuration of Secret Scanning, Dependabot, CodeQL, and best practices.

Review dependency update PRs by blast radius: package-lock changes, semver jumps, bin entries, install scripts, and CI risk gates.

GitHub Action for reviewing dependency changes and policy findings in pull requests with Bomly CLI.

Offline semantic dependency review across npm, pnpm, Yarn, uv, Poetry, Cargo, and Go.

Review Dart and Flutter dependency updates for new build hooks, native files, and plugin platform declarations.

Review pnpm lockfile intent: detect unrelated changes, downgrades, and manifest drift.

Review what a pinned GitHub Action SHA bump actually changes before you approve it.

Autonomous GitHub Action for source-cited npm and PyPI dependency upgrade reviews via UpgradeLens.

🤖 Globomantics Robot Fleet Manager - Educational demo with vulnerable dependencies for GitHub Advanced Security training. Tim Warner's Pluralsight Dependency Review course. Learn more: https://pluralsight.com

A Pi.dev skill focused on risk assessment before modifying dependencies in Node.js projects. It helps the agent analyze package-related changes before installing, updating, migrating, or modifying dependencies

GitHub CLI extension for on-demand PR dependency risk review with Dependency Review API first and static local fallback