---
title: "Check your dependencies"
description: "Run the deps gate, read what it found, set a licence and advisory policy in main.yaml, and keep CI honest when the network is down."
section: "guides"
status: "Building for 0.5"
spec: "dependency-check"
canonical: "https://mainsdk.dev/docs/guides/check-your-dependencies"
updated: "2026-10-28"
---

# Check your dependencies

> Run the deps gate, read what it found, set a licence and advisory policy in main.yaml, and keep CI honest when the network is down.

Status: Building for 0.5 · Canonical: https://mainsdk.dev/docs/guides/check-your-dependencies · Updated: 2026-10-28

You will run the dependency checks on your app, read a finding, set a policy and ignore one advisory with an expiry. It takes about 10 minutes.

## You need

- A MainSDK app with a `main.yaml`, a lockfile (pnpm, npm, yarn or bun) and its packages installed.

## 1. Run the check

```bash
npx mainsdk check
```

The first run asks the registry and OSV.dev and keeps the answers for 24 hours. Findings under `deps` name the package, the version, why and the fix.

## 2. Read a finding

```text
MAIN-DEPS-0001  high  package.json:12
react-query-hooks-pro is not on its registry; a model may have made the name up, and anyone can register it
fix: Remove it or replace it with the package you meant; react-query-hooks-pro does not exist on its registry
```

A name that doesn't exist, one first published days ago (`MAIN-DEPS-0002`) and one a letter from a popular package (`MAIN-DEPS-0003`) are the signs of a name an agent made up or got wrong.

## 3. Set your policy

```yaml title="main.yaml"
deps:
  licences:
    allow: [MIT, Apache-2.0, ISC, BSD-3-Clause]
  advisories:
    fail-on: high
  scripts:
    allow: [esbuild, sharp]
```

An advisory below `fail-on` is a warning. A package that runs an install script and isn't allowed is a warning too (`MAIN-DEPS-0006`).

## 4. Ignore an advisory for a while

```yaml title="main.yaml"
deps:
  advisories:
    ignore:
      - { id: GHSA-xxxx-xxxx-xxxx, until: 2027-01-31, reason: "Not reachable: only used in tests" }
```

Every entry needs an `id`, a future `until` and a `reason`. After `until` the advisory is reported again, with `MAIN-DEPS-0008`.

## 5. Run it in CI

CI has the network, so make a missing answer a failure:

```yaml title="main.yaml"
deps:
  offline: fail
```

On a laptop with no network, `mainsdk check` reports `MAIN-DEPS-0007` as info and still checks licences and install scripts.

## Check it worked

Add a dependency that doesn't exist to `package.json` and run `npx mainsdk check --json`; it exits 1 with `MAIN-DEPS-0001`. Remove it and the exit is 0 again. See [Dependency checks](https://mainsdk.dev/docs/interfaces/deps).