Use case

Gate on vulnerable and risky dependencies

Block builds that pull in vulnerable or unpinned packagesGateTest inventories your dependencies across ten ecosystems and fails the gate on wildcard or unpinned versions, missing lockfiles and deprecated packages — and, for npm projects, on reachable critical/high advisories from npm audit — the supply-chain layer your own code never touches.

The problem

Most of your attack surface is third-party code you didn't write and rarely read. A transitively-pulled package with a fresh CVE, a wildcard pin that lets a malicious update slip in, a dependency abandoned two years ago — none of these show up in a review of your own diff.

Gating the supply chain means evaluating the dependency graph itself, on every change to a lockfile and on a schedule, because a clean dependency today can have a CVE disclosed tomorrow.

How GateTest does it

GateTest's dependencies module resolves manifests across npm, pip, Pipenv, Poetry, go.mod, Cargo, Bundler, Composer, Maven, and Gradle, and flags wildcards, `latest` pins, missing lockfiles, deprecated packages, and git-without-rev specifiers.

Known-vulnerability lookup is the security module's job: for npm projects it runs npm audit and triages every advisory by reachability, so a critical advisory in a package your code actually imports blocks the gate, while dev-only and installed-but-unused advisories are reported without blocking — the noise that makes teams ignore Dependabot.

.github/workflows/gatetest.yml

# .github/workflows/gatetest.yml
name: GateTest
on:
  pull_request:
jobs:
  gate:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 20
      # error-severity findings exit non-zero, fail the job and block the merge
      - run: npx -p @gatetest/cli gatetest --suite full

Steps

1Run GateTest with the dependencies and security modules (both in the full suite).
2Fail the gate on error-severity dependency findings.
3On Scan + Fix, review the PR GateTest opens for the code-level findings; raise the vulnerable pin in the same PR.
4Schedule a periodic re-scan to catch newly-disclosed advisories.

Frequently asked questions

Which ecosystems does GateTest cover?

The dependencies module is polyglot: npm, pip, Pipenv, Poetry, go.mod, Cargo, Bundler, Composer, Maven, and Gradle. It runs with zero network calls against your manifests and lockfiles.

Can it fix a vulnerable dependency automatically?

Partly. The security module's npm audit finding tells you which package, whether a non-breaking fix is available, and whether your code actually reaches it; the Scan + Fix PR targets code-level findings, and a dependency bump is a one-line change you make in the same PR. Automatic version-bump patches only fire when a finding carries a CVE/GHSA id, which the shipped scan does not currently emit.