Audit my project's dependencies for security risks and bloat
A prioritized review of outdated, vulnerable, duplicated, and unused packages, with a safe update order and lockfile hygiene.
The prompt
Audit the dependencies in my software project.
Language and package manager: [e.g. "Node with npm", "Python with Poetry", "Java with Maven"]
Manifest and lockfile: [paste package.json / pyproject.toml / pom.xml, and relevant lockfile sections]
Output of audit or outdated commands: [paste e.g. `npm audit`, `npm outdated`, `pip-audit`, Dependabot alerts]
Runtime and deployment: [e.g. "Node 20, deployed to Lambda", "Python 3.11 in Docker"]
Test coverage: [good / patchy / none]
Return:
1. Vulnerabilities table: Package | Version | Issue and severity | Reachable from our code? | Fix version | Breaking changes expected. Use only the advisories I pasted; do not invent CVE numbers. Where reachability is unclear, mark [CHECK].
2. Outdated packages: grouped as patch / minor / major, with known breaking-change areas to check in each changelog.
3. Bloat and risk: unused dependencies, packages that duplicate each other, dev dependencies shipped to production, unpinned or wildcard versions, unmaintained or single-maintainer packages, and suspicious names that could be typosquats.
4. Conflicts: any version conflicts or peer-dependency problems, with the cause and resolution options.
5. Update plan: a safe order of small batches, what to test after each, and how to roll back.
6. Ongoing hygiene: lockfile committed, automated update PRs, a CI audit step, and a policy for adding new packages.
Put the top 3 actions for this week at the top.
Highlighted [brackets] are blanks to replace with your own details.
Fill in the blanks and use this promptMore Software Development prompts
What to fill in
- e.g. "Node with npm", "Python with Poetry", "Java with Maven"
- e.g. "Node 20, deployed to Lambda", "Python 3.11 in Docker"
- good / patchy / none
- CHECK
How this prompt is built
This prompt follows the Few-Shot structure (Few-shot prompting). A few-shot prompt includes one or more worked examples of the input and the output you want, so the model can copy the pattern instead of guessing it.
Related prompts
- Get a beginner-friendly code review of my first projectA ranked set of the five improvements that matter most, explained simply, plus what you did well and what to learn next.
- Review every change since my last release before shippingA pre-release review of all changes since a tag: missing translations, simplifications, breaking changes, security, and a draft changelog.
- Audit the developer experience of my software package or APIA structured review of your docs, onboarding, community signals, and competitor position, with a prioritized list of developer-experience fixes.
- Restyle a UI component to match a reference designRefactor a component's markup, styles, and accessibility to match a design-system reference while keeping its props, state, and logic intact.