Audit dependencies for vulnerabilities

Set up automated dependency vulnerability scanning in the CI pipeline for a [Language] project. Use [npm audit / Snyk / Dependabot / OWASP Dependency-Check] to scan on every pull request. Configure the step to fail the pipeline when any dependency has a high or critical severity vulnerability. Generate a Software Bill of Materials (SBOM) in CycloneDX or SPDX format as a pipeline artefact. Document a team policy defining acceptable risk levels and the process for triaging, waiving, or remediating flagged vulnerabilities.