/dependency-updater

name: dependency-updater
description: Smart dependency management for any language. Auto-detects project type, applies safe updates automatically, prompts for major versions, diagnoses and fixes dependency issues.
license: MIT
metadata:
  version: 1.0.0

Dependency Updater

Smart dependency management for any language with automatic detection and safe updates.

---

Quick Start

update my dependencies

The skill auto-detects your project type and handles the rest.

---

Triggers

| Trigger | Example | |---------|---------| | Update dependencies | "update dependencies", "update deps" | | Check outdated | "check for outdated packages" | | Fix dependency issues | "fix my dependency problems" | | Security audit | "audit dependencies for vulnerabilities" | | Diagnose deps | "diagnose dependency issues" |

---

Supported Languages

| Language | Package File | Update Tool | Audit Tool | |----------|--------------|-------------|------------| | **Node.js** | package.json | `taze` | `npm audit` | | **Python** | requirements.txt, pyproject.toml | `pip-review` | `safety`, `pip-audit` | | **Go** | go.mod | `go get -u` | `govulncheck` | | **Rust** | Cargo.toml | `cargo update` | `cargo audit` | | **Ruby** | Gemfile | `bundle update` | `bundle audit` | | **Java** | pom.xml, build.gradle | `mvn versions:*` | `mvn dependency:*` | | **.NET** | *.csproj | `dotnet outdated` | `dotnet list package --vulnerable` |

---

Quick Reference

| Update Type | Version Change | Action | |-------------|----------------|--------| | **Fixed** | No `^` or `~` | Skip (intentionally pinned) | | **PATCH** | `x.y.z` → `x.y.Z` | Auto-apply | | **MINOR** | `x.y.z` → `x.Y.0` | Auto-apply | | **MAJOR** | `x.y.z` → `X.0.0` | Prompt user individually |

---

Workflow

User Request
    │
    ▼
┌─────────────────────────────────────────────────────┐
│ Step 1: DETECT PROJECT TYPE                         │
│ • Scan for package files (package.json, go.mod...) │
│ • Identify package manager                          │
├─────────────────────────────────────────────────────┤
│ Step 2: CHECK PREREQUISITES                         │
│ • Verify required tools are installed               │
│ • Suggest installation if missing                   │
├─────────────────────────────────────────────────────┤
│ Step 3: SCAN FOR UPDATES                            │
│ • Run language-specific outdated check              │
│ • Categorize: MAJOR / MINOR / PATCH / Fixed         │
├─────────────────────────────────────────────────────┤
│ Step 4: AUTO-APPLY SAFE UPDATES                     │
│ • Apply MINOR and PATCH automatically               │
│ • Report what was updated                           │
├─────────────────────────────────────────────────────┤
│ Step 5: PROMPT FOR MAJOR UPDATES                    │
│ • AskUserQuestion for each MAJOR update             │
│ • Show current → new version                        │
├─────────────────────────────────────────────────────┤
│ Step 6: APPLY APPROVED MAJORS                       │
│ • Update only approved packages                     │
├─────────────────────────────────────────────────────┤
│ Step 7: FINALIZE                                    │
│ • Run install command                               │
│ • Run security audit                                │
└─────────────────────────────────────────────────────┘

---

Commands by Language

Node.js (npm/yarn/pnpm)

# Check prerequisites
scripts/check-tool.sh taze "npm install -g taze"

# Scan for updates
taze

# Apply minor/patch
taze minor --write

# Apply specific majors
taze major --write --include pkg1,pkg2

# Monorepo support
taze -r  # recursive

# Security
npm audit
npm audit fix

Python

# Check outdated
pip list --outdated

# Update all (careful!)
pip-review --auto

# Update specific
pip install --upgrade package-name

# Security
pip-audit
safety check

Go

# Check outdated
go list -m -u all

# Update all
go get -u ./...

# Tidy up
go mod tidy

# Security
govulncheck ./...

Rust

# Check outdated
cargo outdated

# Update within semver
cargo update

# Security
cargo audit

Ruby

# Check outdated
bundle outdated

# Update all
bundle update

# Update specific
bundle update --conservative gem-name

# Security
bundle audit

Java (Maven)

# Check outdated
mvn versions:display-dependency-updates

# Update to latest
mvn versions:use-latest-releases

# Security
mvn dependency:tree
mvn dependency-check:check

.NET

# Check outdated
dotnet list package --outdated

# Update specific
dotnet add package PackageName

# Security
dotnet list package --vulnerable

---

Diagnosis Mode

When dependencies are broken, run diagnosis:

Common Issues & Fixes

| Issue | Symptoms | Fix | |-------|----------|-----| | **Version Conflict** | "Cannot resolve dependency tree" | Clean install, use overrides/resolutions | | **Peer Dependency** | "Peer dependency not satisfied" | Install required peer version | | **Security Vuln** | `npm audit` shows issues | `npm audit fix` or manual update | | **Unused Deps** | Bloated bundle | Run `depcheck` (Node) or equivalent | | **Duplicate Deps** | Multiple versions installed | Run `npm dedupe` or equivalent |

Emergency Fixes

# Node.js - Nuclear reset
rm -rf node_modules package-lock.json
npm cache clean --force
npm install

# Python - Clean virtualenv
rm -rf venv
python -m venv venv
source venv/bin/activate
pip install -r requirements.txt

# Go - Reset modules
rm go.sum
go mod tidy

---

Security Audit

Run security checks for any project:

# Node.js
npm audit
npm audit --json | jq '.metadata.vulnerabilities'

# Python
pip-audit
safety check

# Go
govulncheck ./...

# Rust
cargo audit

# Ruby
bundle audit

# .NET
dotnet list package --vulnerable

Severity Response

| Severity | Action | |----------|--------| | **Critical** | Fix immediately | | **High**