Dep Auditor

It categorizes issues by severity (CVE vulnerabilities with CVSS scores, packages over two years old, GPL contagion problems) and generates a markdown report with specific upgrade commands. The workflow is straightforward: point it at package.json, requirements.txt, go.mod, or similar files and get actionable fix suggestions. Honest take: this is the kind of audit you should run before major releases but probably won't until a security team asks for it. The automated fix suggestions are handy, though you'll still need to test upgrades carefully since it won't catch breaking changes in your actual code.