dependency-checker — Claude Code hook: dependency audit on edit
A PostToolUse hook that runs a package audit after you touch a dependency file, so outdated or vulnerable packages surface right away.
npx claude-code-templates@latest --hook automation/dependency-checkerWhat dependency-checker does
The hook listens on PostToolUse with the Edit matcher. When the edited file is package.json, requirements.txt, Cargo.toml, pom.xml or Gemfile, it prints the path to the console. For package.json it then runs npm audit and npx npm-check-updates, provided npm is on the machine.
requirements.txt gets safety check -r against that file, but only when safety is installed. Cargo.toml gets cargo audit if cargo is available. Every command is wrapped with error suppression and || true, so a failing audit never kills your session.
pom.xml and Gemfile are only reported as modified — there is no audit step for them in the command. Don't expect Maven or Bundler analysis from this hook. Installation writes into .claude/settings.json, so check that the file exists and that you aren't overwriting settings you already keep there.
What it helps with
- catch vulnerable packages right after editing a manifest
- see which dependencies are behind
- run
safetyagainstrequirements.txt - run
cargo auditafter aCargo.tomlchange - notice that a dependency file was modified
Example prompts for the agent
- I edited package.json, check the dependencies
- I updated requirements.txt — run the audit
- what's outdated in my package.json?
How to install dependency-checker
1claude-code-templates
npx claude-code-templates@latest --hook automation/dependency-checker2Manually: put the files in place
.claude/settings.jsonThe hooks block: event (PreToolUse, PostToolUse, Stop…) → command. Personal ones go to ~/.claude/settings.json
Step by step, with commands for each platform: Claude Code hooks: what they are, where to configure them, how to block a risky command
Questions about dependency-checker
How do I install dependency-checker in Claude?
Run npx claude-code-templates@latest --hook automation/dependency-checker. The hook configuration lands in .claude/settings.json.
What does dependency-checker do?
It watches edits to dependency files and runs audits: npm audit and npx npm-check-updates for package.json, safety check -r for requirements.txt, cargo audit for Cargo.toml.
What tools does the hook need?
npm for package.json, safety for requirements.txt, cargo for Cargo.toml. Without the tool installed, that particular check is skipped.
Source text
dependency-checker.json · MIT
{
"description": "Advanced dependency analysis and security checking. Monitors for outdated packages, security vulnerabilities, and license compatibility.",
"hooks": {
"PostToolUse": [
{
"matcher": "Edit",
"hooks": [
{
"type": "command",
"command": "if [[ \"$CLAUDE_TOOL_FILE_PATH\" == *package.json || \"$CLAUDE_TOOL_FILE_PATH\" == *requirements.txt || \"$CLAUDE_TOOL_FILE_PATH\" == *Cargo.toml || \"$CLAUDE_TOOL_FILE_PATH\" == *pom.xml || \"$CLAUDE_TOOL_FILE_PATH\" == *Gemfile ]]; then echo \"Dependency file modified: $CLAUDE_TOOL_FILE_PATH\"; if [[ \"$CLAUDE_TOOL_FILE_PATH\" == *package.json ]] && command -v npm >/dev/null 2>&1; then npm audit 2>/dev/null || true; npx npm-check-updates 2>/dev/null || true; elif [[ \"$CLAUDE_TOOL_FILE_PATH\" == *requirements.txt ]] && command -v safety >/dev/null 2>&1; then safety check -r \"$CLAUDE_TOOL_FILE_PATH\" 2>/dev/null || true; elif [[ \"$CLAUDE_TOOL_FILE_PATH\" == *Cargo.toml ]] && command -v cargo >/dev/null 2>&1; then cargo audit 2>/dev/null || true; fi; fi"
}
]
}
]
}
}
© davila7 · MIT · davila7/claude-code-templates
