Check the versions recorded in the lockfile
A dependency scan needs actual versions, rather than only a package name or broad version range. Keep the npm lockfile committed and current so a release review can compare the recorded versions with published vulnerability information.
Known vulnerabilities and application context
A matching advisory tells you to investigate the affected package and version. Review the advisory, whether the vulnerable code path is reachable, and the available remediation. A clean query does not exclude unpublished issues or application-logic vulnerabilities.
Test dependency updates before release
Check the fixed version and release notes, update the dependency and lockfile, then run tests and the production build. Do not assume that replacing a version number alone resolves every risk or preserves your application’s behaviour.
Current package-manager coverage
The implemented dependency check supports npm package-lock files. Yarn, pnpm and Python lockfile checks are not currently included. The repository scan has file-selection and size limits, so review the report’s coverage when working with large projects.
Frequently asked questions
Does the free scan include npm dependency checks?+
Yes. The supported npm dependency check is included with the built-in scan; the deeper AI code review is a separate Pro or credits feature.
Does it support yarn.lock or pnpm-lock.yaml?+
Not currently. The implemented dependency check supports npm package-lock.json.
Does Quick Scan First install or execute dependencies?+
No. This check reads the lockfile and queries vulnerability records. It is not a sandboxed install or runtime test.
Sources and current provider information
Reviewed 14 October 2026. Provider capabilities and terms can change.