Code
Audit your dependencies
An SBOM, the vulnerabilities that actually apply, and an upgrade order.
Fill it in
Where it is.
Skip vulnerabilities in code paths you never call.
Ordered by risk and by what breaks.
Your prompt
Audit the dependencies of [the project]. Produce a CycloneDX SBOM, then the vulnerabilities. Filter by REACHABILITY. A raw scanner report on a real project returns hundreds of findings, most in code paths the application never executes, and the effect is that the three that matter get lost. Say which are actually callable and show how you determined it. For each real finding: what an attacker gets, whether it needs authentication, and whether a fixed version exists. Order the upgrades by risk against breakage. The critical CVE behind a major version bump that breaks forty files is not the first thing to do on a Tuesday, and pretending otherwise means nothing gets done.
Use Audit your dependenciesOpens with everything above already filled in.
Why this works
A raw scanner report returns hundreds of findings, most in code paths the application never executes, and the three that matter get lost. This filters by reachability, says what an attacker actually gets, and orders upgrades by risk against breakage.