jouet deps audit

• Usage: jouet deps audit [--ecosystem <ECOSYSTEM>] [--refresh]

Check the project's locked dependencies against OSV

Reads the nearest Cargo.lock, npm-family lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock, bun.lock), uv.lock or poetry.lock, and go.mod, from here up to the repository's root, and asks OSV about every package version they lock from a public registry, in batches. Lists only the packages an advisory affects, each with its advisory IDs, severity and the first version that fixes it.

Exits 1 when any locked package is affected, 3 when there is no lockfile, and 5 when OSV cannot be reached.

Examples: jouet deps audit jouet deps audit --ecosystem npm

Flags

• --ecosystem <ECOSYSTEM> — Only this ecosystem's lockfile: cargo, npm, pypi or go
• --refresh — Ask OSV again rather than reading the cache
• -h --help — Print help