Show pending dependency alerts from the last background scan. This reads the cache file written by the background checker (no live scan, instant response).

If no cache exists, suggests running depsonar_scan or setting up the background checker.

Examples:

• "Any dependency alerts?"

• "Do any of my projects need updates?"

• "Show depsonar alerts"

Check a project for outdated dependencies. Supports Node.js, Python, Rust, Go, PHP, Ruby, and Dart/Flutter.

Groups results by ecosystem for Node projects. Flags major version updates.

Examples:

• "Check JobPin for outdated deps"

• "What needs updating in my Django project?"

Update dependencies for a project. Works with any supported language.

Three safety levels:

• patch: Bugfixes only (safest)

• minor: New features, no breaking changes (default)

• latest: Includes major breaking changes

Examples:

• "Update all deps in JobPin"

• "Update svelte in Showly to latest"

• "Update my Python project dependencies"

Scan all projects in your workspace. Auto-detects language (Node, Python, Rust, Go, PHP, Ruby, Dart) and framework.

Can filter by framework or language.

Examples:

• "Scan all my projects"

• "Which Python projects need updates?"

• "Show all SvelteKit projects status"

Batch update across all projects. Defaults to dry_run=true (safe preview).

Can filter by framework or language.

Examples:

• "Update all my projects"

• "Update all SvelteKit projects, apply changes"

• "Preview updates for all Python projects"

Score a project from 0-100. Checks outdated deps, security issues, lockfile.

Examples:

• "How healthy is JobPin?"

• "Health report for my Rust project"

Fresh install. Use clean=true to nuke node_modules/vendor first.

Examples:

• "Install deps for JobPin"

• "Clean install my project"

Install or remove the background dependency checker. On macOS, uses launchd (native, lightweight). On Linux, uses cron.

The checker runs on schedule, scans all projects, writes results to ~/.depsonar-cache.json, then exits. Zero RAM between runs, zero AI tokens, zero cost.

Results are shown by depsonar_alerts.

Examples:

• "Setup background dependency checking"

• "Check my deps every 12 hours"

• "Remove the background checker"

View or update configuration. Saved to ~/.depsonarrc.json.

Examples:

• "Show depsonar config"

• "Set projects directory to ~/Code"

Scan projects for known security vulnerabilities (CVEs). Uses npm audit, cargo audit, pip-audit, composer audit, govulncheck.

CRITICAL: Run this after any CVE announcement (e.g. Svelte CVE-2026-22775, devalue DoS).

Examples:

• "Audit all my projects for vulnerabilities"

• "Security scan JobPin"

• "Any CVEs in my SvelteKit projects?"

Check installed runtime versions (Node.js, Python, Rust, Go, PHP, Ruby, Dart, Swift). Detects EOL and outdated versions. Also checks project version files (.nvmrc, .python-version, rust-toolchain.toml, engines.node).

Examples:

• "Check my runtime versions"

• "Is my Node.js up to date?"

• "Any runtime mismatches in my projects?"

Check versions of globally installed tools: npm, pnpm, yarn, bun, composer, cargo, pip, typescript, git, docker, homebrew, vercel-cli, supabase-cli, wrangler.

Shows installed vs latest version and update commands.

Examples:

• "Check my global tools"

• "Is pnpm up to date?"

• "Show all CLI tool versions"

Scan Dockerfile and docker-compose files for outdated or EOL base images. Checks: node, python, ruby, php, golang, rust, nginx, postgres, redis, ubuntu, alpine.

Examples:

• "Check my Docker images"

• "Any EOL images in my projects?"

Scan GitHub Actions workflow files for outdated or deprecated actions. Knows 30+ popular actions (actions/checkout, docker/build-push-action, cloudflare/wrangler-action, etc.).

Examples:

• "Check my GitHub Actions versions"

• "Any deprecated actions in my workflows?"

Validate project environments: .env/.env.example sync, lockfile freshness, tsconfig best practices, Svelte config (detects deprecated svelte-preprocess with Svelte 5, duplicate adapters, etc.), multiple lockfiles.

Examples:

• "Check my project environments"

• "Any env issues in JobPin?"

• "Validate all project configs"

Complete infrastructure health check in one command. Combines: runtime versions, global toolchain, security audit, CVE advisories, Docker images, GitHub Actions, environment configs, secret scanning, license compliance, deprecated packages, and optionally dependency scan.

This is the "run everything" command. Use when you want a full picture.

Examples:

• "Full infrastructure report"

• "Check everything"

• "How's my dev environment?"

Check projects against known framework CVEs (Svelte, SvelteKit, devalue, Next.js, Vite, Express, Axios). Goes beyond npm audit by checking a curated database of framework-specific vulnerabilities.

CRITICAL after any CVE announcement. Run immediately when new CVEs are published.

Examples:

• "Check my projects for known CVEs"

• "Any Svelte CVEs affecting my code?"

• "Show CVE database"

Detect deprecated, unmaintained, or replaced packages. Checks both npm deprecated flags and a curated list of known replacements (moment→dayjs, node-fetch→native fetch, request→undici, etc.).

Examples:

• "Any deprecated packages in my projects?"

• "Check JobPin for deprecated deps"

• "Find packages that should be replaced"

Scan project files for exposed secrets, API keys, tokens, and credentials. Detects: AWS keys, GitHub tokens, Stripe keys, Supabase JWT, OpenAI/Anthropic keys, private keys, database URLs, generic API key patterns.

Also checks that .env files are properly gitignored.

Examples:

• "Scan my projects for exposed secrets"

• "Any leaked API keys in JobPin?"

• "Secret scan all projects"

Check dependency licenses for commercial/SaaS compatibility. Flags: GPL/AGPL (copyleft, requires source disclosure), non-commercial (CC-BY-NC), unknown licenses.

Important for SaaS products to avoid legal issues.

Examples:

• "Check license compliance for RoomPilot"

• "Any GPL dependencies in my projects?"

• "License audit all projects"

Real-time vulnerability scan using the osv.dev API. Checks every installed package against the global OSV database (npm, PyPI, crates.io, Go, Packagist, RubyGems, Pub).

Unlike depsonar_audit (which uses local tools like npm audit), this queries the live osv.dev database for the most up-to-date vulnerability data. No API key needed.

Examples:

• "Live CVE scan all my projects"

• "Check RoomPilot for vulnerabilities with osv.dev"

• "Real-time security scan"

Check changelogs and breaking changes before updating. Shows major/minor/patch breakdown with changelog URLs and release notes for breaking updates.

Run this BEFORE depsonar_update to understand what will change.

Examples:

• "Show changelog for RoomPilot before updating"

• "What breaking changes are pending in my project?"

• "Check what changed in latest versions"

Detect framework migration needs by scanning code for deprecated patterns. Currently supports: Svelte 4→5, Next.js 13→14→15.

Finds exact file locations of code that needs to change, with migration instructions for each pattern.

Examples:

• "Check if my projects need Svelte 5 migration"

• "Migration scan for all projects"

• "What Svelte 4 patterns are still in my code?"

Fetch up-to-date documentation, changelogs, and migration guides for any npm package directly from source (GitHub + npm registry).

Use this BEFORE writing code that depends on a library, to get the latest API docs and avoid hallucinating outdated APIs.

Sections available:

• readme: Latest README with API docs, examples, setup instructions

• changelog: Recent release notes (last 5 versions) with breaking changes

• migration: Migration/upgrade guides (supports Svelte, Next.js, Tailwind, Vite, Stripe, Supabase, Better Auth, etc.)

Combine with a query to focus on a specific topic (e.g. query="runes" for Svelte 5 migration docs).

Examples:

• "Get Svelte 5 docs focused on runes migration"

• "Show me the Supabase JS changelog"

• "What changed in Tailwind CSS v4?"

• "Get Better Auth setup docs"

Search the npm registry for packages by name or keyword. Returns matching packages with name, latest version, and description.

Use this to find the right package name before calling depsonar_docs.

Examples:

• "Search for Svelte authentication libraries"

• "Find Stripe payment packages"

• "What Tailwind utility packages exist?"