# dependencies

> Checks for known advisories, one version per package, exact pins, one package manager, and a lockfile that matches its dependency file.

Checks for known advisories, one version per package, exact pins, one package manager, and a lockfile that matches its dependency file. The [Dependencies and licenses guide](/checks/dependencies/) explains the setup.

## Checks

| Check                                                                     | Stage    | Level         | What it does                                                                                                             |
| ------------------------------------------------------------------------- | -------- | ------------- | ------------------------------------------------------------------------------------------------------------------------ |
| [`dependencies/osv-scanner`](/reference/checks/dependencies/osv-scanner/) | `push`   | `recommended` | Looks up every locked dependency in the Open Source Vulnerabilities (OSV) advisory database.                             |
| [`dependencies/syncpack`](/reference/checks/dependencies/syncpack/)       | `push`   | `all`         | Checks that every workspace package resolves each dependency to one version.                                             |
| [`dependencies/lockfiles`](/reference/checks/dependencies/lockfiles/)     | `commit` | `recommended` | Checks that npm, pnpm, Yarn, and text Bun lockfile downloads in each project scope use HTTPS and allowed registry hosts. |

## Settings

| Setting                                                                                         | What it sets                                                                                    |
| ----------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------- |
| [`dependencies.min_release_age_days`](/reference/gspot-toml/#dependencies.min_release_age_days) | How many days a new release waits before gspot installs it as one of its tools in .gspot.       |
| [`dependencies.allowed_registries`](/reference/gspot-toml/#dependencies.allowed_registries)     | The hosts a lockfile may resolve packages from.                                                 |
| [`dependencies.bun_scanner`](/reference/gspot-toml/#dependencies.bun_scanner)                   | The npm package that Bun runs as its install security scanner. Without it, Bun runs no scanner. |

## Selected when

Always selected.

## Rules for coding agents

| Rule file                                                          | Installed when |
| ------------------------------------------------------------------ | -------------- |
| `.gspot/configurations/general/dependencies/rules/DEPENDENCIES.md` | Always         |

## Tools and versions

| Tool        | Version  |
| ----------- | -------- |
| osv-scanner | `2.6.0`  |
| syncpack    | `15.3.3` |

## Files gspot writes

gspot writes `.gspot/configurations/general/dependencies/osv-scanner.toml` and `.gspot/configurations/general/dependencies/syncpack.json`.