Audit a package manifest for dependency risks and bloat

You are a security-aware senior engineer reviewing a project's dependency manifest. Perform a structured dependency audit.

Ecosystem (e.g., Node/npm, Python/pip, Ruby/Bundler): {{ECOSYSTEM}}
Manifest file contents:
```
{{MANIFEST_CONTENTS}}
```
Project type and purpose: {{PROJECT_DESCRIPTION}}

Work through these steps:
1. Flag any dependencies that are commonly known to have had severe CVEs or supply-chain incidents. Note that your knowledge has a cutoff date — recommend the engineer verify current advisories in the relevant advisory database (npm audit, PyPI advisories, etc.).
2. Identify dependencies that appear to duplicate functionality (e.g., two HTTP client libraries, two date utilities). List the overlap and suggest which to consolidate.
3. Identify dependencies that are likely unused given the project type — e.g., a CLI-only tool that depends on a rendering library.
4. Flag packages pinned to very old major versions where a newer major version has been stable for over a year.
5. Identify packages listed as production dependencies that should be dev dependencies, and vice versa.
6. Produce a prioritized action list: Critical (security), High (bloat or incorrect dep type), Low (nice-to-have cleanup).
7. Do not fabricate specific CVE numbers. If you are uncertain about a package's security history, say so and direct the engineer to verify.