Checks dependency health by running:

1. mix deps.unlock --check-unused - Detects dependencies in mix.lock that are no longer referenced in mix.exs
2. mix deps.audit --format json - Scans dependencies for known security vulnerabilities using the mix_audit package

Both checks run in parallel and results are combined.

This stage always runs (unused dependency check). The security audit is automatically enabled only if :mix_audit is in deps.

Findings

Each vulnerability becomes a finding against the lockfile that holds the vulnerable version, naming the advisory, the version in use and the version that fixes it:

mix.lock
  -  [error] plug 1.13.6: Arbitrary code execution (high severity, patched in 1.14.0) (GHSA-xxxx-yyyy-zzzz)

The advisory is read from mix_audit's JSON report rather than counted out of its human output, where a substring search for Advisory: counted headings and one for severity: high counted whatever happened to say so.

Unused dependencies become findings too, because a stage that rendered only half of what it found would hide the other half. Either half that does not parse turns findings off for the whole stage, so the tools' output is printed in full instead.