@codelaw/rules-deps

codelaw's dependency rules — one of the first-party rule packs (SR-RULE-PACKS decision 15), on npm and PyPI (codelaw-rules-deps). It tells you, and your coding agent, which npm and Python dependencies are vulnerable and the exact version to move to, and which are behind their latest release.

codelaw init adds it when the repo has a package.json or pyproject.toml.

# codelaw.toml
extends = ["codelaw:deps/recommended"]
preview = true   # every rule is `preview` until a corpus run promotes it

npm i -D @codelaw/rules-deps      # or
pip install codelaw-rules-deps
codelaw deps refresh              # the one command that reads the network

Presets

Rules

How it works

The rules read .codelaw/deps-snapshot.json, which codelaw deps refresh writes and the project commits, and the lockfiles — never the network, so codelaw check gives the same answer offline and in CI.

• Advisory sources are [deps] advisory_sources, each on or off: registry (the npm registry and Python index you already install from) first, then osv (https://api.osv.dev), or a mirror of either. Every enabled source is read and merged — the safer answer wins. A source that cannot be read is recorded, and deps/incomplete-scan says so.
• The version to move to is the lowest version every advisory leaves clean and some source actually covered, inside the major in use first.
• Agents ask check_dependency (MCP) or codelaw deps check before adding a package; [deps] agent sets, per severity, whether the hooks only inform or also block.

The pack holds no advisory data: the snapshot keeps ids, ranges, versions, a severity, a URL and the sources' names — never an advisory's text.