{"id":83010,"date":"2025-03-05T10:03:54","date_gmt":"2025-03-05T18:03:54","guid":{"rendered":"https:\/\/github.blog\/?p=83010"},"modified":"2025-04-25T05:55:26","modified_gmt":"2025-04-25T12:55:26","slug":"video-how-to-run-dependency-audits-with-github-copilot","status":"publish","type":"post","link":"https:\/\/github.blog\/developer-skills\/github\/video-how-to-run-dependency-audits-with-github-copilot\/","title":{"rendered":"Video: How to run dependency audits with GitHub Copilot"},"content":{"rendered":"\n

Every software project faces the inevitable challenge of dependency management. Over time, dependencies become outdated, leading to security vulnerabilities. Others go unused, needlessly bloating build times. For many development teams, addressing these issues means running manual scripts, reviewing output files, and hoping nothing falls through the cracks.<\/p>\n

I recently transformed this error-prone manual process into an automated solution using a few tools on GitHub—GitHub Copilot, GitHub Actions, and Dependabot, to be specific (just in case you’re wondering). Here’s how you can do the same!<\/p>\n

So, let’s jump in (and make sure to watch the video above, too!).<\/p>\n

The problem with manual dependency audits<\/span><\/a><\/h2>\n

Most teams start with a simple approach to dependency management. This often includes a Bash script that runs periodically. Here’s what our manual script looks like:<\/p>\n

#!\/bin\/bash\necho \"Starting manual dependency audit...\"\n\n# List all dependencies\necho \"Installed dependencies:\"\nnpm list --depth=0 > deps.txt\ncat deps.txt\n\n# Check for outdated ones\necho -e \"\\nChecking outdated dependencies...\"\nnpm outdated > outdated.txt\ncat outdated.txt\n\n# Guess at unused ones (very crude)\necho -e \"\\nLooking for potentially unused dependencies...\"\nfor dep in $(npm list --depth=0 | grep '├──' | cut -d' ' -f2 | cut -d@ -f1); do\n    if ! find . -type f -name \"*.js\" -o -name \"*.tsx\" -o -name \"*.ts\" | xargs grep -l \"$dep\" > \/dev\/null 2>&1; then\n        echo \"$dep might be unused\"\n    fi\ndone\n\necho \"Done! Check deps.txt and outdated.txt manually. Phew that was a lot of work!\"\n<\/code><\/pre>\n
This approach has several limitations, including:<\/p>\n