devflow-kit 3.11.0 → 3.12.0

package/src/assets/skills/complexity/SKILL.md

@@ -1,134 +1,38 @@
 ---
 name: complexity
-description: This skill should be used when reviewing code for deep nesting or long functions.
+description: Use when reviewing code for deep nesting or long functions.
 user-invocable: false
 allowed-tools: Read, Grep, Glob
 ---
 
 # Complexity Patterns
 
-Domain expertise for code complexity and maintainability analysis. Use alongside `devflow:review-methodology` for complete complexity reviews.
+Detection patterns for complexity and maintainability review. Use with `devflow:review-methodology`.
 
 ## Iron Law
 
-> **IF YOU CAN'T UNDERSTAND IT IN 5 MINUTES, IT'S TOO COMPLEX**
+> **If you can't understand it in 5 minutes, it's too complex.**
 >
 > Every function should be explainable to a colleague in under 5 minutes. If you need a
 > diagram to understand control flow, refactor. If you need comments to explain what
 > (not why), the code is too clever. Simplicity is a feature, complexity is a bug.
 
----
-
 ## Complexity Categories
 
-### 1. Cyclomatic Complexity
-
-High decision path count makes code hard to test and understand.
-
-**Violation**: Deep nesting (5+ levels)
-```typescript
-if (order) {
-  if (order.items) {
-    for (const item of order.items) {
-      if (item.quantity > 0) {
-        if (item.product?.inStock) {
-          // Buried logic
-```
-
-**Solution**: Early returns and extraction
-```typescript
-function processOrder(order: Order) {
-  if (!order?.items) return;
-  for (const item of order.items) processItem(item);
-}
-
-function processItem(item: OrderItem) {
-  if (item.quantity <= 0 || !item.product?.inStock) return;
-  // Logic at top level
-}
-```
-
-### 2. Readability Issues
-
-Code that requires mental effort to parse.
-
-**Violation**: Magic values
-```typescript
-if (status === 3) {
-  setTimeout(callback, 86400000);
-}
-```
-
-**Solution**: Named constants
-```typescript
-const OrderStatus = { COMPLETED: 3 } as const;
-const ONE_DAY_MS = 24 * 60 * 60 * 1000;
-
-if (status === OrderStatus.COMPLETED) {
-  setTimeout(callback, ONE_DAY_MS);
-}
-```
-
-### 3. Maintainability Issues
-
-Code that's expensive to change.
-
-**Violation**: Long parameter lists
-```typescript
-function createUser(name, email, password, role, dept, manager, startDate, salary) { }
-```
-
-**Solution**: Object parameter
-```typescript
-interface CreateUserParams {
-  name: string; email: string; password: string;
-  role: string; department: string; manager?: string;
-  startDate: Date; salary: number;
-}
-function createUser(params: CreateUserParams) { }
-```
-
-### 4. Boolean Complexity
-
-Conditions that are hard to reason about.
-
-**Violation**: Complex boolean expression
-```typescript
-if (user.active && !user.deleted && (user.role === 'admin' || user.role === 'moderator') && user.verified && (!user.suspended || user.suspendedUntil < Date.now())) { }
-```
-
-**Solution**: Extract to named predicate
-```typescript
-const canModerate = (user: User): boolean => {
-  if (!user.active || user.deleted || !user.verified) return false;
-  if (!['admin', 'moderator'].includes(user.role)) return false;
-  if (user.suspended && user.suspendedUntil >= Date.now()) return false;
-  return true;
-};
-
-if (canModerate(user)) { }
-```
-
-### 5. Reliability Patterns
-
-Operations that risk non-termination or resource exhaustion. See `devflow:reliability` for
-full coverage of bounded iteration, assertion density, allocation discipline, and indirection limits.
-Complexity-relevant: unbounded loops increase cyclomatic complexity and make termination reasoning harder.
-
----
+1. **Cyclomatic complexity**: many decision paths, deep nesting (5+ levels). Fix: early returns and extracted functions.
+2. **Readability**: magic values (`status === 3`, `86400000`). Fix: named constants.
+3. **Maintainability**: long parameter lists (5+). Fix: one typed object parameter.
+4. **Boolean complexity**: long compound conditions (5+ terms). Fix: extract a named predicate with early returns.
+5. **Reliability patterns**: operations that risk non-termination or resource exhaustion. Unbounded loops add decision paths and make termination hard to reason about. `devflow:reliability` covers bounded iteration, assertion density, allocation discipline and indirection limits.
 
 ## Extended References
 
-For extended examples and detection techniques:
-
 | Reference | Content |
 |-----------|---------|
 | `references/violations.md` | Extended violation examples for all categories |
 | `references/patterns.md` | Detailed refactoring solutions |
 | `references/detection.md` | Bash commands and static analysis setup |
 
----
-
 ## Severity Guidelines
 
 | Severity | Criteria |

package/src/assets/skills/compliance/SKILL.md

@@ -1,16 +1,12 @@
 ---
 name: compliance
-description: This skill should be used when reviewing code that handles PII, payments or health data.
+description: Use when reviewing code that handles PII, payments or health data.
 user-invocable: false
 allowed-tools: Read, Grep, Glob
 ---
 
 # Compliance Patterns
 
-<!-- Composition tokens (5): DEVFLOW_COMPLIANCE_SCOPE, DEVFLOW_COMPLIANCE_ACTIVE,
-     DEVFLOW_COMPLIANCE_MAPPING, DEVFLOW_COMPLIANCE_CHECKLIST, DEVFLOW_COMPLIANCE_REFERENCES.
-     Dynamic sections compose from frameworks/{id}/fragment.md at install time (C1: token-free shadows pass through). -->
-
 Regulatory compliance review for code that touches regulated data ${DEVFLOW_COMPLIANCE_SCOPE}. Use alongside `devflow:security` for complete coverage.
 
 ## Iron Law
@@ -26,7 +22,7 @@ ${DEVFLOW_COMPLIANCE_ACTIVE}
 
 ## Scope Boundary
 
-Compliance covers regulatory-specific gaps: retention, erasure/data-subject rights, audit-trail completeness (actor/purpose fields), segregation of duties, framework mapping, IaC exposure. Do NOT re-raise security lens findings (injection, secret handling, authN/Z) — reference those via framework mapping only.
+Compliance covers regulatory-specific gaps: retention, erasure/data-subject rights, audit-trail completeness (actor/purpose fields), segregation of duties, framework mapping, IaC exposure. Do not re-raise security lens findings (injection, secret handling, authN/Z) — reference those via framework mapping only.
 
 **Lens only.** This skill shapes what a compliance review looks for in the diff or design. It does not decide how much evidence a change must carry: tracker links, test plans, approvals and release traces follow the repository's evidence policy. Never report a missing ticket, test plan or approval as a compliance finding.
 
@@ -36,61 +32,12 @@ If the diff/design has no regulated-data surface (no PII/PHI/payment fields, no
 
 ## Control Categories
 
-### 1. Data Classification & Minimization
-```typescript
-// VULNERABLE: full SSN stored when only last-4 needed
-user.ssn = req.body.ssn;
-// COMPLIANT: store minimum; annotate purpose + retention
-user.ssnLast4 = req.body.ssn.slice(-4); // retention: 90d for verification
-```
-
-### 2. Sensitive Data in Logs & Errors
-```typescript
-// VULNERABLE: PII in structured log
-logger.info('login', { email, password, creditCard });
-// COMPLIANT: omit or mask regulated fields
-logger.info('login', { userId, ip });
-```
-
-### 3. Encryption In Transit & At Rest
-```typescript
-// VULNERABLE: plaintext PHI written to disk
-fs.writeFileSync('/data/patients.json', JSON.stringify(records));
-// COMPLIANT: encrypt before write; TLS enforced at transport
-await vault.encrypt(records, { key: 'phi-key', algo: 'AES-256-GCM' });
-```
-
-### 4. Audit Trails & Change Traceability
-```typescript
-// VULNERABLE: mutation with no audit entry; no segregation of duties
-await db.update('orders', { status: 'refunded' }, { id });
-// COMPLIANT: append-only audit before state change; actor ≠ approver
-await audit.append({ actor, action: 'refund', target: id, purpose, ts: Date.now() });
-await db.update('orders', { status: 'refunded' }, { id });
-```
-
-### 5. Retention & Erasure
-```typescript
-// VULNERABLE: PII stored with no deletion path
-await db.insert('user_pii', { userId, ssn, email });
-// COMPLIANT: TTL field + erasure handler registered at write time
-await db.insert('user_pii', { userId, ssn, email, retainUntil: addDays(90) });
-await erasure.register(userId, ['user_pii']);
-```
-
-### 6. Environments & IaC
-```hcl
-# VULNERABLE: public bucket, no encryption, no access logging
-resource "aws_s3_bucket" "data" { acl = "public-read" }
-# COMPLIANT: private, encrypted, logging enabled
-resource "aws_s3_bucket_acl" "data" { acl = "private" }
-resource "aws_s3_bucket_server_side_encryption_configuration" "data" {
-  rule { apply_server_side_encryption_by_default { sse_algorithm = "AES256" } }
-}
-resource "aws_s3_bucket_logging" "data" { target_bucket = var.audit_bucket_id }
-```
-
----
+1. **Data Classification & Minimization**: store the minimum the purpose needs (the last 4 digits, not the full SSN). Every stored field has a declared purpose and retention period.
+2. **Sensitive Data in Logs & Errors**: no PII/PHI/payment data in logs, errors or analytics events. Omit or mask regulated fields.
+3. **Encryption In Transit & At Rest**: encrypt regulated data before it is written, and enforce TLS 1.2+ in transit.
+4. **Audit Trails & Change Traceability**: every regulated mutation writes an append-only audit entry (actor, action, target, purpose, timestamp) before the state change. Segregation of duties: the actor is not the approver, and no one self-approves a regulated state change.
+5. **Retention & Erasure**: every stored regulated field has a retention limit and a deletion path, registered at write time.
+6. **Environments & IaC**: no public buckets or security groups, no unencrypted volumes or stores, no wildcard IAM, and access logging on.
 
 ## Severity
 
@@ -106,12 +53,7 @@ ${DEVFLOW_COMPLIANCE_MAPPING}
 ## Checklist
 
 - [ ] Frameworks in force are the ids your prompt names; their controls applied
-- [ ] No PII/PHI/payment data in logs, errors, or analytics events
-- [ ] Regulated data encrypted in transit (TLS 1.2+) and at rest
-- [ ] Every regulated mutation has an append-only audit entry (actor, purpose, timestamp)
-- [ ] All stored fields have a declared purpose, retention period, and deletion path
-- [ ] Segregation of duties enforced — no self-approval of regulated state changes
-- [ ] IaC scanned: no public buckets/SGs, no unencrypted volumes, no wildcard IAM
+- [ ] Each control category above checked against the diff or design
 ${DEVFLOW_COMPLIANCE_CHECKLIST}
 
 ## Extended References

package/src/assets/skills/consistency/SKILL.md

@@ -1,120 +1,35 @@
 ---
 name: consistency
-description: This skill should be used when reviewing code for naming or pattern inconsistencies.
+description: Use when reviewing code for naming or pattern inconsistencies.
 user-invocable: false
 allowed-tools: Read, Grep, Glob
 ---
 
 # Consistency Patterns
 
-Domain expertise for code consistency and unnecessary simplification detection. Use alongside `devflow:review-methodology` for complete consistency reviews.
+Detection patterns for consistency and unnecessary simplification review. Use with `devflow:review-methodology`.
 
 ## Iron Law
 
-> **MATCH EXISTING PATTERNS OR JUSTIFY DEVIATION**
+> **Match existing patterns or justify deviation.**
 >
 > New code should look like existing code. If the codebase uses camelCase, use camelCase.
 > If errors return Result types, return Result types. Consistency trumps personal preference.
 > Deviation requires explicit justification and team agreement. One codebase, one style.
 
----
-
 ## Consistency Categories
 
-### 1. Unnecessary Simplification
-
-Content truncation, stripped configuration, removed error context.
-
-```typescript
-// VIOLATION: Oversimplified error messages
-const errorMessages = {
-  INVALID_EMAIL: 'Invalid email',  // Was: detailed format guidance
-  USER_NOT_FOUND: 'Not found',     // Was: helpful next steps
-};
-
-// CORRECT: Preserve helpful context
-const errorMessages = {
-  INVALID_EMAIL: 'Please enter a valid email address in the format user@domain.com',
-  USER_NOT_FOUND: 'We could not find an account with that email. Please check or create a new account.',
-};
-```
-
-### 2. Pattern Violations
-
-Naming conventions, error handling styles, import/export organization.
-
-```typescript
-// EXISTING PATTERN: Result types
-function existingFunction(): Result<User, Error> {
-  if (!valid) return Err(new ValidationError('...'));
-  return Ok(user);
-}
-
-// VIOLATION: Throws instead of Result
-function newFunction(): User {
-  if (!valid) throw new Error('...');  // Different pattern!
-  return user;
-}
-
-// CORRECT: Match existing
-function newFunction(): Result<User, Error> {
-  if (!valid) return Err(new ValidationError('...'));
-  return Ok(user);
-}
-```
-
-### 3. Feature Regression
-
-Removed CLI options, changed return types, removed event emissions.
-
-```typescript
-// VIOLATION: Removed event emissions break listeners
-class OrderService {
-  async createOrder(data: OrderData) {
-    const order = await this.repository.create(data);
-    return order;  // Events removed - listeners won't fire!
-  }
-}
-
-// CORRECT: Preserve all event emissions
-class OrderService {
-  async createOrder(data: OrderData) {
-    const order = await this.repository.create(data);
-    this.events.emit('order.created', order);
-    this.events.emit('inventory.reserve', order.items);
-    return order;
-  }
-}
-```
-
-### 4. Style Inconsistency
-
-Brace style, quote style, trailing commas, naming conventions.
-
-```typescript
-// EXISTING: camelCase for functions
-function getUserById(id: string) { }
-function createOrder(data: OrderData) { }
-
-// VIOLATION: Different naming style
-function Process_Payment(amount: number) { }  // snake_case
-
-// CORRECT: Match existing
-function processPayment(amount: number) { }
-```
-
----
+1. **Unnecessary simplification**: user-facing content shortened (detailed error messages cut to "Not found"), configuration options silently removed, error context stripped.
+2. **Pattern violations**: naming conventions, error-handling style (a new function throws where the codebase returns `Result`), import organization and export style that differ from existing modules.
+3. **Feature regression**: CLI options or flags removed without deprecation, return types changed, event emissions removed (listeners stop firing). Every removed function needs explicit justification.
+4. **Style inconsistency**: brace style, quote style, trailing commas, naming case (`Process_Payment` among camelCase functions).
 
 ## Extended References
 
-For extended examples and detection commands, see:
-
 - `references/violations.md` - Extended violation examples by category
 - `references/patterns.md` - Extended correct pattern examples
 - `references/detection.md` - Bash commands for detecting issues
 
----
-
 ## Severity Guidelines
 
 | Severity | Description | Examples |
@@ -123,18 +38,3 @@ For extended examples and detection commands, see:
 | **HIGH** | Inconsistency requiring attention | Error handling pattern mismatch, naming violations, export pattern change |
 | **MEDIUM** | Style inconsistency | Import organization, brace/quote style, formatting differences |
 | **LOW** | Minor observations | Personal preference territory, linter should catch |
-
----
-
-## Consistency Checklist
-
-Before approving changes, verify:
-
-- [ ] Naming matches existing patterns (camelCase, PascalCase, etc.)
-- [ ] Error handling matches existing approach (throw vs Result)
-- [ ] Import organization matches existing files
-- [ ] Export style matches existing modules
-- [ ] No user-facing content was unnecessarily shortened
-- [ ] No configuration options were silently removed
-- [ ] No CLI flags/options were removed without deprecation
-- [ ] All removed functionality has explicit justification

package/src/assets/skills/database/SKILL.md

@@ -1,17 +1,17 @@
 ---
 name: database
-description: This skill should be used when reviewing queries, migrations or schema changes.
+description: Use when reviewing queries, migrations or schema changes.
 user-invocable: false
 allowed-tools: Read, Grep, Glob
 ---
 
 # Database Patterns
 
-Domain expertise for database design and optimization. Use alongside `devflow:review-methodology` for complete database reviews.
+Detection patterns for database design and query review. Use with `devflow:review-methodology`.
 
 ## Iron Law
 
-> **EVERY QUERY MUST HAVE AN EXECUTION PLAN**
+> **Every query must have an execution plan.**
 >
 > Never deploy a query without understanding its execution plan. Every WHERE clause needs
 > an index analysis. Every JOIN needs cardinality consideration. "It works in dev" is not
@@ -28,19 +28,6 @@ Domain expertise for database design and optimization. Use alongside `devflow:re
 | Poor Data Types | VARCHAR for everything, lost precision | Use appropriate types (DECIMAL, BOOLEAN, TIMESTAMP) |
 | Missing Constraints | No data validation at DB level | Add NOT NULL, CHECK, UNIQUE constraints |
 
-**Example - Missing Constraints:**
-```sql
--- VIOLATION
-CREATE TABLE products (id SERIAL, name VARCHAR(100), price DECIMAL);
-
--- CORRECT
-CREATE TABLE products (
-  id SERIAL PRIMARY KEY,
-  name VARCHAR(100) NOT NULL CHECK (LENGTH(TRIM(name)) > 0),
-  price DECIMAL(10, 2) NOT NULL CHECK (price >= 0)
-);
-```
-
 ### 2. Query Optimization Issues
 
 | Issue | Problem | Solution |
@@ -50,17 +37,6 @@ CREATE TABLE products (
 | Full Table Scans | Functions prevent index use | Functional indexes or query rewrite |
 | Inefficient JOINs | Joining before filtering | Filter early, select specific columns |
 
-**Example - N+1 Query:**
-```typescript
-// VIOLATION: 101 queries for 100 users
-for (const user of users) {
-  user.orders = await db.query('SELECT * FROM orders WHERE user_id = ?', [user.id]);
-}
-
-// CORRECT: 2 queries total
-const orders = await db.query('SELECT * FROM orders WHERE user_id = ANY($1)', [userIds]);
-```
-
 ### 3. Migration Issues
 
 | Issue | Problem | Solution |
@@ -68,17 +44,7 @@ const orders = await db.query('SELECT * FROM orders WHERE user_id = ANY($1)', [u
 | Breaking Changes | Data loss, no recovery path | Phased approach with backups |
 | Data Loss Risk | Type changes truncate data | Validate before changing types |
 | Missing Rollback | Cannot undo migration | Always implement down() method |
-| Performance Impact | Table locks during migration | Add columns nullable, backfill in batches |
-
-**Example - Safe Column Addition:**
-```sql
--- Step 1: Add nullable (instant)
-ALTER TABLE users ADD COLUMN phone VARCHAR(20);
--- Step 2: Backfill in batches
-UPDATE users SET phone = 'UNKNOWN' WHERE phone IS NULL AND id BETWEEN 1 AND 10000;
--- Step 3: Add constraint after backfill
-ALTER TABLE users ALTER COLUMN phone SET NOT NULL;
-```
+| Performance Impact | Table locks during migration | Add columns nullable, backfill in batches, then add the constraint |
 
 ### 4. Security Issues
 
@@ -87,27 +53,11 @@ ALTER TABLE users ALTER COLUMN phone SET NOT NULL;
 | SQL Injection | String interpolation in queries | Parameterized queries only |
 | Excessive Privileges | App has GRANT ALL | Minimum required privileges |
 
-**Example - SQL Injection:**
-```typescript
-// VULNERABLE
-const query = `SELECT * FROM users WHERE email = '${email}'`;
-
-// SECURE
-const query = 'SELECT * FROM users WHERE email = $1';
-await db.query(query, [email]);
-```
-
----
-
 ## Extended References
 
-For detailed examples and detection commands, see:
-
-- **[references/violations.md](references/violations.md)** - Extended violation examples with explanations
-- **[references/patterns.md](references/patterns.md)** - Correct patterns and migration strategies
-- **[references/detection.md](references/detection.md)** - Automated detection commands
-
----
+- `references/violations.md` - Extended violation examples with explanations
+- `references/patterns.md` - Correct patterns and migration strategies
+- `references/detection.md` - Automated detection commands
 
 ## Severity Guidelines
 
@@ -117,18 +67,3 @@ For detailed examples and detection commands, see:
 | **HIGH** | Significant database issues | Inefficient JOINs, missing constraints, migrations without rollback |
 | **MEDIUM** | Moderate concerns | Minor denormalization, missing non-critical indexes |
 | **LOW** | Minor improvements | Naming conventions, index organization |
-
----
-
-## Database Checklist
-
-Before approving database changes:
-
-- [ ] All queries have appropriate indexes
-- [ ] N+1 patterns identified and resolved
-- [ ] Migrations have rollback scripts
-- [ ] Data types are appropriate
-- [ ] Constraints enforce business rules
-- [ ] Foreign keys maintain referential integrity
-- [ ] No SQL injection vulnerabilities
-- [ ] Performance tested with production-like data volume

package/src/assets/skills/dependencies/SKILL.md

@@ -1,106 +1,35 @@
 ---
 name: dependencies
-description: This skill should be used when reviewing dependency or lock file changes.
+description: Use when reviewing dependency or lock file changes.
 user-invocable: false
 allowed-tools: Read, Grep, Glob
 ---
 
 # Dependencies Patterns
 
-Domain expertise for dependency management and security analysis. Use alongside `devflow:review-methodology` for complete dependency reviews.
+Detection patterns for dependency management and supply-chain review. Use with `devflow:review-methodology`.
 
 ## Iron Law
 
-> **EVERY DEPENDENCY IS AN ATTACK SURFACE**
+> **Every dependency is an attack surface.**
 >
 > Each package you add is code you didn't write but must trust. Minimize dependencies.
 > Pin versions. Audit regularly. A single compromised transitive dependency can compromise
 > your entire application. "It's a popular package" is not a security review.
 
----
-
 ## Dependency Categories
 
-### 1. Security Vulnerabilities
-
-Known CVEs, vulnerable version ranges, malicious packages.
-
-**Violation**: Wide version range includes vulnerable versions
-```json
-{ "lodash": "^4.0.0" }  // Includes vulnerable 4.17.0-4.17.20
-```
-
-**Correct**: Pin to safe version
-```json
-{ "lodash": "^4.17.21" }  // First safe version
-```
-
-### 2. Version Management
-
-Unpinned versions, missing lockfiles, dependency conflicts.
-
-**Violation**: Unpinned allows any version
-```json
-{ "express": "*", "lodash": "latest" }
-```
-
-**Correct**: Pin with lockfile
-```json
-{ "express": "^4.18.2" }  // + committed lockfile
-```
-
-### 3. Dependency Health
-
-Outdated packages, unused dependencies, unnecessary heavy packages.
-
-**Violation**: Heavy dependency for simple task
-```json
-{ "moment": "^2.29.4" }  // 300KB for date formatting
-```
-
-**Correct**: Use native or lighter alternative
-```typescript
-new Date().toLocaleDateString();  // Native
-```
-
-### 4. License Issues
-
-Incompatible licenses (GPL in MIT project), missing licenses.
-
-**Violation**: GPL in proprietary code
-```bash
-# GPL-3.0: some-package  # Requires your code to be GPL too!
-```
-
-**Correct**: Use permissive licenses only
-```bash
-npx license-checker --failOn "GPL-3.0;AGPL-3.0"
-```
-
-### 5. Supply Chain Risks
-
-Deep transitive dependencies, unmaintained packages, typosquatting.
-
-**Violation**: Typosquatted package
-```json
-{ "loadsh": "1.0.0" }  // Typosquat of "lodash"
-```
-
-**Correct**: Verify package authenticity
-```bash
-npm view loadsh  # Check downloads, repo, maintainers
-```
-
----
+1. **Security vulnerabilities**: known CVEs in added packages, version ranges that include vulnerable versions (`"lodash": "^4.0.0"` includes 4.17.0-4.17.20), malicious packages.
+2. **Version management**: unpinned versions (`"*"`, `"latest"`), ranges too wide, lockfile missing or not updated, dependency conflicts.
+3. **Dependency health**: unmaintained or outdated packages, unused dependencies, heavy packages for simple tasks (`moment` for date formatting) where a native or lighter alternative exists, bundle size impact.
+4. **License issues**: incompatible licenses (GPL in MIT or proprietary code), missing licenses.
+5. **Supply chain risks**: deep transitive dependencies, unverified publishers, typosquatting (`loadsh` for `lodash`).
 
 ## Extended References
 
-For extended examples and detection commands, see:
 - `references/violations.md` - Extended violation examples by category
 - `references/patterns.md` - Correct dependency management patterns
-- `references/detection.md` - Detection commands and CI integration
-
----
+- `references/detection.md` - Detection commands, CI integration and advisory sources
 
 ## Severity Guidelines
 
@@ -110,32 +39,3 @@ For extended examples and detection commands, see:
 | **HIGH** | High severity CVEs, unmaintained packages, GPL in proprietary code |
 | **MEDIUM** | Medium CVEs, significantly outdated, wide version ranges, missing lockfile |
 | **LOW** | Unused dependencies, lighter alternatives available, minor version behind |
-
----
-
-## Dependency Review Checklist
-
-Before approving dependency changes:
-
-- [ ] No known CVEs in added packages
-- [ ] Version ranges appropriate (not too wide)
-- [ ] Lockfile updated and committed
-- [ ] Package actively maintained
-- [ ] License compatible
-- [ ] Package from verified publisher
-- [ ] Transitive dependencies reviewed
-- [ ] Package name verified (not typosquat)
-- [ ] Bundle size impact considered
-- [ ] Native alternatives considered
-
----
-
-## Common Vulnerability Sources
-
-| Registry | URL |
-|----------|-----|
-| npm Advisory | https://www.npmjs.com/advisories |
-| Snyk Vuln DB | https://snyk.io/vuln |
-| GitHub Advisory | https://github.com/advisories |
-| NVD | https://nvd.nist.gov/ |
-| CISA KEV | https://www.cisa.gov/known-exploited-vulnerabilities-catalog |