Dependency & Supply Chain Risk Gate

Most of a project's risk isn't in code the team wrote — it's in the hundreds of transitive packages it pulled in: known CVEs, abandoned libraries, a typosquatted name one character off a popular package, an install script doing something it shouldn't, or a copyleft license in a proprietary product. This gate orchestrates the right tooling and adds the human-judgment layer scanners can't: • Detects the ecosystem and lockfiles (npm/pnpm/yarn, pip/Poetry, Go, Cargo, Bundler, Maven, and more) • Runs the appropriate scanner against live advisory data — never stale memory of CVEs • Triages by severity × reachability × fix availability, flagging breaking-change fixes • Flags outdated, deprecated, and abandoned packages • Surfaces supply-chain signals tooling misses — typosquatting, low-trust packages, risky install scripts, non-registry sources, ownership changes — flagged to verify, never accused • Checks license risk (informational, not legal advice) • Returns a prioritized fix list and a PASS / REVIEW / BLOCK verdict It catches the fixable critical that actually matters and tells you the one upgrade to make first — not a wall of raw audit output.