Dependency Management

Quick Reference

Task	Use
Ecosystem defaults and package-manager choice	references/ecosystem-guides.md
Lockfiles and CI install policy	references/lockfile-management.md
Security scanning, SBOMs, and provenance	references/security-scanning.md, assets/automation/template-supply-chain-security.md, assets/automation/template-sbom-vuln-triage-checklist.md
Monorepos and workspace policy	references/monorepo-patterns.md, assets/nodejs/pnpm-workspace-template.yaml
Update strategy and rollback	references/update-strategies.md, assets/automation/template-dependency-upgrade-playbook.md
Add-or-avoid dependency decision	references/dependency-selection-guide.md, references/transitive-dependencies.md
Vulnerability detection	The ecosystem's native audit tool (`npm audit`, `pnpm audit`, `pip-audit`, `cargo audit`, `govulncheck`, `composer audit`) or `osv-scanner`; see references/security-scanning.md
Vulnerability triage, VEX, EU CRA lookup	references/security-scanning.md
Policy-manifest scorer (not a vulnerability scanner: no advisory database, refuses real manifests, exits 2 on unchecked input)	`python3 scripts/dep_auditor.py --help`, limits in scripts/README.md