List a project's resolved dependencies by parsing its lockfiles/manifests (Cargo.lock, package-lock.json, package.json, requirements.txt, go.mod/go.sum). Returns each dependency's name, version, and ecosystem. Use this to give the assistant ground-truth about exactly which packages and versions a project actually uses.

Cross-reference a project's resolved dependencies against the OSV.dev vulnerability database and report which packages have known advisories (CVE/GHSA/RUSTSEC/PYSEC), with computed severity. Only reports advisories for packages actually present in the dependency tree — not generic noise. Requires network access to api.osv.dev.