Audits third-party dependencies for risk: maintenance health, blast radius, replaceability, and lock-in.