Use GitHub's private vulnerability reporting on this repository: Report a vulnerability. Do not open a public issue. Include the version and a minimal project that reproduces it.

check-imports reads the source files and package.json files of the directory it is given, asks the npm registry for the latest versions, and, with --update, writes those package.json files. It runs no code from the project it checks.

Releases from 2.0.0 on are published from GitHub Actions with npm provenance. npm audit signatures in a project that installs it checks the signature and the attestation.

Fixes ship in the latest version — no backports. The software is provided as is, without warranty of any kind, per the MIT license.