PruneoDependencies: vulnerable or outdated packages in your projects
The Dependencies section checks all your projects at once: it reads their lockfiles, without touching them, and matches them against OSV.dev, CISA's catalog of exploited vulnerabilities and endoflife.date. It tells you which packages have security flaws, which are malicious, deprecated or very old, and which runtimes lost support, with the command to update.
If you code, your Mac is full of projects with hundreds of dependencies each. Some have known vulnerabilities, others were abandoned years ago, and the runtime of some old project no longer gets patches. Nobody checks them one by one. Pruneo checks them all at once.
What it checks
For each project, Pruneo reads its lockfile and flags:
- Known vulnerabilities, from OSV.dev, Google’s open database that brings together advisories from GitHub, PyPI, RustSec, Go and others.
- Exploited vulnerabilities, from CISA’s KEV catalog: the ones already used in real attacks.
- Malicious packages, published to steal data or credentials.
- Deprecated or yanked packages, withdrawn by their authors.
- Very old packages, several versions behind the current one.
- Unsupported runtimes, like a Node or Python version that stopped getting patches, from endoflife.date.
For each issue, it shows the command to update. It never touches the project.
Which files it reads
| Ecosystem | Files |
|---|---|
| JavaScript | package-lock.json, npm-shrinkwrap.json, pnpm-lock.yaml, yarn.lock, bun.lock |
| Rust | Cargo.lock |
| Go | go.mod |
| Python | poetry.lock, uv.lock, Pipfile.lock, requirements.txt |
| Java and Kotlin | pom.xml, gradle.lockfile, build.gradle, build.gradle.kts |
| Ruby | Gemfile.lock |
| PHP | composer.lock |
| Dart and Flutter | pubspec.lock |
| Swift | Package.resolved |
Privacy: matching happens locally
The first time, Pruneo downloads OSV.dev’s public databases for the ecosystems you use to your Mac, and updates them at most once a day. Matching them against your projects happens on your Mac.
Looking up the official registries (npm, crates.io, PyPI…), which tells whether a package is deprecated or very old, is optional. If you turn it on, it only sends each package’s name and version.
How to use it
- In the app: Professional › Dependencies. The first time it asks you to turn it on. You can turn it off or delete what was downloaded in Settings.
- In the terminal:
pruneo deps.
FAQ
Which languages and package managers does it support?
npm, pnpm, Yarn and Bun; Cargo (Rust); Go; Poetry, uv, Pipenv and requirements.txt (Python); Maven and Gradle (Java and Kotlin); Bundler (Ruby); Composer (PHP); Pub (Dart and Flutter) and Swift Package Manager.
Does it send my code to a server?
No. Pruneo downloads OSV.dev's public databases to your Mac and does the matching there. Only if you turn on registry lookups (npm, crates.io, PyPI…) are each package's name and version sent, never your code.
Does Pruneo update my dependencies?
No. It never touches your projects: it shows the issue and the command to update, and you run it.
Is it on by default?
No. It's optional: you turn it on in the Dependencies section or in Settings, where you can also turn it off or delete what was downloaded.
Can I use it from the terminal?
Yes, with pruneo deps.