Audit my project's dependencies for known vulnerabilities. Run my package manager's audit command (npm audit, or the equivalent for my stack) and review the results with me. For each reported vulnerability: identify whether the affected package is actually used in a way that exposes the vulnerable code path (a dev-only build tool is lower risk than a package parsing user input at runtime), then fix it. Prefer upgrading within the existing package. If a fix requires a major version bump, check the changelog for breaking changes before applying and update my code where the API changed. If a package is abandoned and unfixable, propose a maintained replacement. Do not blindly run audit fix --force; it applies major upgrades that can silently break the app. Do not remove packages that are still imported somewhere. After each change, make sure the app still builds and the relevant feature still works. Give me a summary table: package, severity, whether it's exploitable in my usage, and what you did. Flag anything you couldn't fix and tell me the mitigation (for example, the vulnerable function is never called with user input).