Scan a project's direct and transitive dependencies for known CVEs and advisories, triage findings by reachability and severity, and remediate by upgrading, pinning, or applying overrides — use when auditing supply-chain risk, before a release, when a CVE is announced, or when setting up automated dependency scanning in CI.
