Dependencies
Supply-chain hygiene across npm, pip, Pipenv, Poetry, go.mod, Cargo, Bundler, Composer, Maven, Gradle.
One of 122 modules in the GateTest scan suite. Catches the issue before it reaches code review, and on paid tiers opens a pull request with the fix already written.
left-pad in package.json pinned to 'latest' — supply-chain risk
Why we catch it
Catches the supply-chain takeovers, container exploits, and CI/CD foot-guns.
The Dependencies module sits in this category alongside 6 related modules. Together they form one of the layers of a GateTest scan — checks fire in parallel, findings cluster by root cause, and on paid tiers the AI auto-fix loop reads each finding, writes the fix, validates against the scanner, and opens a PR.
How GateTest covers dependencies
- Runs on every Full scan and above. Full ($99), Scan + Fix ($199) and Forensic ($399) — every repository tier except Quick ($29), which runs only 4 modules. No additional configuration.
- Free CLI.
npm i -g @gatetest/cli && gatetest --module dependenciesagainst any local repo. No paywall on the scanning itself. - AI auto-fix PR. Scan + Fix tier opens a pull request with the fix, a regression test, and a pair-review by a second AI reviewer. Forensic Scan tier adds per-finding diagnosis and cross-finding attack-chain correlation.
- Honest confidence rating. Findings come with high / medium / low confidence so noisy patterns don't block the gate. The confidence-calibrator trainer reads customer suppressions and tightens rules over time.
Scan your repo for dependencies
Free preview of the headline findings. Pay per scan, not per seat — one-time scans never auto-renew.
Frequently asked questions
What does the Dependencies module catch?
Supply-chain hygiene across npm, pip, Pipenv, Poetry, go.mod, Cargo, Bundler, Composer, Maven, Gradle. Example finding: left-pad in package.json pinned to 'latest' — supply-chain risk
Does GateTest fix Dependencies issues automatically?
Yes — on the Scan + Fix tier ($199) and Forensic Scan tier ($399), the fix engine reads the finding, writes the fix, validates against the scanner, writes a regression test, and opens a pull request for your review.
Which tiers include the Dependencies module?
Full ($99), Scan + Fix ($199) and Forensic ($399) — every repository tier except Quick ($29), which runs only 4 modules.
Can I run the Dependencies module from the CLI for free?
Yes — install with `npm i -g @gatetest/cli` and run `gatetest --module dependencies`. The local CLI is free; paid tiers add AI auto-fix and the cross-finding correlation work.