# `ExQuality.Stages.Dependencies`
[🔗](https://github.com/riddler/ex_quality/blob/v0.16.0/lib/ex_quality/stages/dependencies.ex#L1)

Checks dependency health by running:

1. `mix deps.unlock --check-unused` - Detects dependencies in mix.lock
   that are no longer referenced in mix.exs
2. `mix deps.audit --format json` - Scans dependencies for known security
   vulnerabilities using the mix_audit package

Both checks run in parallel and results are combined.

This stage always runs (unused dependency check). The security audit
is automatically enabled only if `:mix_audit` is in deps.

## Findings

Each vulnerability becomes a finding against the lockfile that holds the
vulnerable version, naming the advisory, the version in use and the version
that fixes it:

    mix.lock
      -  [error] plug 1.13.6: Arbitrary code execution (high severity, patched in 1.14.0) (GHSA-xxxx-yyyy-zzzz)

The advisory is read from mix_audit's JSON report rather than counted out of
its human output, where a substring search for `Advisory:` counted headings
and one for `severity: high` counted whatever happened to say so.

Unused dependencies become findings too, because a stage that rendered only
half of what it found would hide the other half. Either half that does not
parse turns findings off for the whole stage, so the tools' output is printed
in full instead.

# `run`

```elixir
@spec run(keyword()) :: ExQuality.Stage.result()
```

Runs the dependencies stage.

## Config options

- `check_unused` - Check for unused dependencies (default: true)
- `audit` - Run security audit if available (default: :auto)
- `audit_available` - Whether mix_audit is available (set by auto-detection)

---

*Consult [api-reference.md](api-reference.md) for complete listing*