Dependency Scanning in Depth: NuGetAudit, npm audit, Dependabot and Prioritizing Findings
Sorting dependency findings by CVSS score is not enough: urgency is set by exploitation evidence in KEV, EPSS's 30-day exploitation probability and whether your code actually reaches the vulnerable function. At Bookstore we configure NuGetAudit at the repo level and show with real output how .NET 10 package pruning removes false positives, an expiring NuGetAuditSuppress, a triage tool that queries EPSS and KEV, and separating security from version updates in Dependabot.
14 Nov 2026
·
13 min
·
4
