Review Dependency Risk Findings with Vibgrate CLI

The Dependency Risk Scanner classifies risk across your dependency tree: deprecated packages, native modules, and platform-specific dependencies that tend to cause upgrade pain. This tutorial runs a scan and reviews those findings so you can prioritize what to fix.

Prerequisites

• Node.js installed
• A project with dependencies

Steps

1. Install the CLI

npm i -g @vibgrate/cli

2. Scan the project

From your project root:

vg

Bare vg scans the current directory. The scan runs the extended scanners, including the Dependency Risk Scanner, and reports your DriftScore.

3. Generate a readable report

Turn the scan artifacts into a human-readable report:

vg report

The report consolidates findings, including the dependency risk classification, into a readable document.

4. Review the dependency risk findings

In the report, look for the dependency risk section. It flags packages classified as deprecated, native modules that complicate cross-platform builds, and platform-specific dependencies. Each finding tells you which package is implicated and why it carries risk.

5. Prioritize remediation

Start with deprecated packages, since those will eventually stop receiving fixes. Native and platform-specific modules come next, especially if you target multiple platforms. Use these findings to plan upgrades that lower your DriftScore.

Verification

vg exits 0 on a clean run, and vg report produces a document containing the dependency risk findings. The presence of classified packages confirms the scanner ran.

Next Steps

Export a CycloneDX SBOM alongside the report for a full inventory, and surface known-vulnerable dependencies to combine risk classification with vulnerability awareness.