dependencies

Checks for known advisories, one version per package, exact pins, one package manager, and a lockfile that matches its dependency file. The Dependencies and licenses guide explains the setup.

Checks

Check	Stage	Level	What it does
dependencies/osv-scanner	push	recommended	Looks up every locked dependency in the Open Source Vulnerabilities (OSV) advisory database.
dependencies/syncpack	push	all	Checks that every workspace package resolves each dependency to one version.
dependencies/lockfiles	commit	recommended	Checks that npm, pnpm, Yarn, and text Bun lockfile downloads in each project scope use HTTPS and allowed registry hosts.

Settings

Setting	What it sets
dependencies.min_release_age_days	How many days a new release waits before gspot installs it as one of its tools in .gspot.
dependencies.allowed_registries	The hosts a lockfile may resolve packages from.
dependencies.bun_scanner	The npm package that Bun runs as its install security scanner. Without it, Bun runs no scanner.

Selected when

Always selected.

Rules for coding agents

Rule file	Installed when
.gspot/configurations/general/dependencies/rules/DEPENDENCIES.md	Always

Tools and versions

Tool	Version
osv-scanner	2.6.0
syncpack	15.3.3

Files gspot writes

gspot writes .gspot/configurations/general/dependencies/osv-scanner.toml and .gspot/configurations/general/dependencies/syncpack.json.