dependency-risk-review

---
name: dependency-risk-review
description: Reviews third-party dependencies for supply-chain and licence risk. Use when the user asks to audit dependencies, evaluate whether to add a package, review a lockfile diff, or check licence compatibility.
---

# Dependency risk review

## When to use this
A dependency is being added, a lockfile diff needs review, or the user wants a
supply-chain or licence audit.

## Procedure
1. For each dependency under review, gather: version, licence, install count,
   last publish date, maintainer count, and its own transitive dependency count.
2. Score it against [references/risk-matrix.md](references/risk-matrix.md).
3. Report anything scoring **high** with a named alternative or a rationale for
   accepting the risk.
4. For a lockfile diff, focus on packages that are newly introduced or that
   changed major version. Ignore patch bumps of already-trusted packages.

## Rules
- A small utility with one maintainer and no publishes in two years is a higher
  risk than a large well-maintained package. Size is not the risk signal.
- Always state the licence explicitly. "Permissive" is not a licence.
- Never recommend adding a dependency for functionality achievable in under
  roughly twenty lines of readable code.

# Dependency risk matrix

| Signal | Low | Medium | High |
| --- | --- | --- | --- |
| Maintainers | 3+ | 2 | 1 |
| Last publish | < 6 months | 6-24 months | > 24 months |
| Transitive deps | 0-3 | 4-15 | > 15 |
| Licence | MIT / Apache-2.0 / BSD | MPL / LGPL | GPL / AGPL / none |
| Install scripts | none | optional | required postinstall |

Any single **high** in Licence or Install scripts is disqualifying for a
commercial product until explicitly accepted by the owner.