Vulnerability Management

Dependency surface

CodyMaster is a Node.js package (package.json) with runtime deps (CLI, Express, SQLite) and dev deps (TypeScript, Vitest, Playwright, VitePress for docs builds).

Routine commands

npm audit
npm audit fix

Use judgment: not every advisory applies to your deployment mode (e.g. dev-only tools).

When npm install reports vulnerabilities

1. Classify — runtime vs dev-only vs transitive.
2. Reproduce — minimal script or test proving exposure.
3. Upgrade path — prefer semver-safe bumps; run npm run test:gate:kit.
4. Document — note security fixes in release notes / Changelog.

Downstream consumers

If you embed CodyMaster as a dependency:

• Pin versions in your app.
• Run your own CI gate mirroring test:gate:kit where feasible.
• Keep cm-safe-deploy checks and pre-commit scanning enabled in your product repos.

See also

• Security overview
• Testing and release gates