Dependency Management

Name: Dependency Management
Author: 89jobrien

89jobrien/steve

29 installs
4 repo stars
Updated April 11, 2026
89jobrien/steve

dependency-management is a Claude Code skill that updates dependencies, scans for vulnerabilities, checks license compliance, and resolves version conflicts across npm, pip, Maven, and other package managers.

About

dependency-management is a Claude Code skill for managing project dependencies. A developer uses it to update packages safely, scan for known vulnerabilities, verify license compatibility, and resolve version conflicts across npm, pip, Maven, and other managers. It bundles a Python parser for dependency files and reference docs of per-manager commands.

Updates dependencies and scans for security vulnerabilities across package managers
Checks license compliance and resolves version conflicts
Bundles a Python parser for package.json, requirements.txt, and pyproject.toml

Dependency Management by the numbers

29 all-time installs (skills.sh)
Ranked #865 of 1,435 DevOps & CI/CD skills by installs in the Skillselion catalog
Data as of Jul 28, 2026 (Skillselion catalog sync)

At a glance

dependency-management capabilities & compatibility

Capabilities: dependency management · vulnerability scanning · license compliance
Use cases: security audit
Pricing: Free

From the docs

What dependency-management says it does

Dependency management specialist. Use when updating dependencies, scanning for vulnerabilities, analyzing dependency trees, or ensuring license compliance.

SKILL.md

This skill manages project dependencies including updates, vulnerability scanning, license compliance, and dependency tree optimization.

SKILL.md

npx skills add https://github.com/89jobrien/steve --skill dependency-management

Add your badge

Show developers this skill is listed on Skillselion. Paste this into your README.

[![Listed on Skillselion](https://skillselion.com/badge/skills/89jobrien/steve/dependency-management.svg)](https://skillselion.com/skills/89jobrien/steve/dependency-management)

Installs	29
repo stars	★ 4
Last updated	April 11, 2026
Repository	89jobrien/steve ↗

What it does

Use it to update dependencies, scan for vulnerabilities, check license compliance, and resolve version conflicts across package managers.

Who is it for?

Updating packages safely and scanning for known vulnerabilities across multiple package managers.

Skip if: Runtime application debugging or non-dependency infrastructure work.

When should I use this skill?

When updating dependencies, scanning for vulnerabilities, analyzing dependency trees, or ensuring license compliance.

What you get

Up-to-date, vulnerability-scanned dependencies with verified license compliance.

vulnerability scan report
dependency audit
license compliance report

By the numbers

6 documented capabilities
1 Python dependency parser (parse_dependencies.py)

Files

SKILL.mdMarkdownGitHub ↗

Dependency Management

This skill manages project dependencies including updates, vulnerability scanning, license compliance, and dependency tree optimization.

When to Use This Skill

When updating project dependencies
When scanning for security vulnerabilities
When analyzing dependency trees
When ensuring license compliance
When resolving version conflicts
When optimizing dependency usage

What This Skill Does

1. Dependency Analysis: Identifies unused dependencies and version conflicts 2. Vulnerability Scanning: Finds and fixes known security vulnerabilities 3. License Compliance: Verifies dependency licenses are compatible 4. Safe Updates: Updates dependencies with testing and validation 5. Tree Optimization: Optimizes dependency trees and reduces bloat 6. Version Management: Resolves version conflicts and updates

Helper Scripts

This skill includes Python helper scripts in scripts/:

`parse_dependencies.py`: Parses dependency files (package.json, requirements.txt, pyproject.toml). Outputs JSON with parsed dependencies and metadata.

  python scripts/parse_dependencies.py package.json requirements.txt

How to Use

Manage Dependencies

Update all dependencies and check for vulnerabilities

Scan dependencies for security issues

Specific Tasks

Check license compatibility for all dependencies

Management Process

1. Analyze Dependencies

Using Helper Script:

The skill includes a Python helper script for parsing dependency files:

# Parse dependency files
python scripts/parse_dependencies.py package.json requirements.txt pyproject.toml

Package Manager Tools:

npm: npm outdated, npm list
pip: pip list --outdated
maven: mvn versions:display-dependency-updates
gradle: gradle dependencyUpdates

2. Scan for Vulnerabilities

Tools:

npm: npm audit
pip: pip-audit
maven: OWASP Dependency Check
gradle: Dependency Check plugin

3. Check Licenses

Process:

List all dependency licenses
Check compatibility with project license
Identify any incompatible licenses
Provide license report

4. Update Dependencies

Safe Update Process:

1. Check for updates 2. Review changelogs 3. Update incrementally 4. Run tests after each update 5. Verify functionality

Examples

Example 1: Vulnerability Scan

Input: Scan for vulnerabilities

Output:

## Dependency Vulnerability Scan

### Critical Vulnerabilities

**1. lodash (4.17.20)**
- **Severity**: High
- **Issue**: Prototype Pollution
- **Fix**: Update to 4.17.21

npm update lodash


**2. express (4.16.4)**

- **Severity**: Medium
- **Issue**: Path Traversal
- **Fix**: Update to 4.18.2

npm update express


### Summary

- **Total vulnerabilities**: 5
- **Critical**: 1
- **High**: 2
- **Medium**: 2

Reference Files

For package manager-specific commands and patterns, load reference files as needed:

`references/package_managers.md` - Commands and patterns for npm, pip, Poetry, Maven, Gradle, Cargo, and common dependency management patterns
`references/DEPENDENCY_AUDIT.template.md` - Dependency audit report template with vulnerabilities, outdated packages, license compliance

When working with specific package managers, load references/package_managers.md and refer to the relevant package manager section.

Best Practices

Dependency Management

1. Regular Updates: Update dependencies regularly 2. Security First: Prioritize security updates 3. Test After Updates: Always test after updating 4. Lock Files: Use lock files (package-lock.json, yarn.lock) 5. Version Pinning: Pin critical dependencies

Related Use Cases

Dependency updates
Security vulnerability scanning
License compliance
Dependency tree optimization
Version conflict resolution

Dependency Audit Report

Project: {{PROJECT_NAME}} Date: {{YYYY-MM-DD}} Package Manager: {{NPM|PIP|CARGO|GO}}

---

Summary

Category	Count	Status
Total Dependencies	{{N}}	-
Direct	{{N}}	-
Transitive	{{N}}	-
Outdated	{{N}}	{{WARN}}
Vulnerable	{{N}}	{{CRITICAL}}
Deprecated	{{N}}	{{WARN}}

---

Security Vulnerabilities

Critical

Package	Version	CVE	Description	Fix Version
{{PKG}}	{{VER}}	{{CVE-XXXX}}	{{DESC}}	{{VER}}

High

Package	Version	CVE	Description	Fix Version
{{PKG}}	{{VER}}	{{CVE-XXXX}}	{{DESC}}	{{VER}}

Medium/Low

Package	Severity	CVE	Fix Available
{{PKG}}	{{SEV}}	{{CVE}}	{{YES/NO}}

---

Outdated Dependencies

Major Updates Available

Package	Current	Latest	Breaking Changes
{{PKG}}	{{VER}}	{{VER}}	{{YES/NO}}

Minor Updates Available

Package	Current	Latest	Risk
{{PKG}}	{{VER}}	{{VER}}	{{LOW}}

Patch Updates Available

Package	Current	Latest
{{PKG}}	{{VER}}	{{VER}}

---

License Compliance

License Distribution

License	Count	Compliant
MIT	{{N}}	{{YES}}
Apache-2.0	{{N}}	{{YES}}
GPL-3.0	{{N}}	{{CHECK}}
Unknown	{{N}}	{{REVIEW}}

Flagged Packages

Package	License	Issue
{{PKG}}	{{LICENSE}}	{{ISSUE}}

---

Deprecated Packages

Package	Deprecation Notice	Replacement
{{PKG}}	{{REASON}}	{{ALTERNATIVE}}

---

Unused Dependencies

Package	Last Used	Safe to Remove
{{PKG}}	{{DATE/NEVER}}	{{YES/NO}}

---

Dependency Tree Issues

Duplicate Versions

Package	Versions	Locations
{{PKG}}	{{V1}}, {{V2}}	{{PATHS}}

Circular Dependencies

{{CYCLE_1}}

Deep Nesting (>5 levels)

Package	Depth	Path
{{PKG}}	{{N}}	{{PATH}}

---

Recommendations

Immediate (Security)

1. [ ] Upgrade {{PKG}} to {{VER}} - fixes {{CVE}} 2. [ ] Upgrade {{PKG}} to {{VER}} - fixes {{CVE}}

Short-term (Maintenance)

1. [ ] Remove unused {{PKG}} 2. [ ] Replace deprecated {{PKG}} with {{ALT}}

Long-term (Health)

1. [ ] Consolidate duplicate versions of {{PKG}} 2. [ ] Evaluate alternatives for {{PKG}}

---

Update Commands

{{UPDATE_COMMANDS}}

Safe Updates (Non-breaking)

{{SAFE_UPDATE_COMMAND}}

Major Updates (Review Required)

{{MAJOR_UPDATE_COMMAND}}

---

Audit Commands Used

{{AUDIT_COMMANDS}}

---

Quality Checklist

[ ] All critical vulnerabilities addressed
[ ] License compliance verified
[ ] Unused dependencies removed
[ ] Deprecated packages replaced
[ ] Lock file updated
[ ] Tests pass after updates

Package Manager Reference

Reference guide for different package managers and their commands for dependency management.

npm (Node.js)

Dependency Commands

List dependencies:

npm list                    # Show dependency tree
npm list --depth=0          # Show only top-level
npm outdated                # Show outdated packages

Update dependencies:

npm update                  # Update all within semver
npm update <package>        # Update specific package
npm install <package>@latest  # Update to latest version

Security:

npm audit                   # Check for vulnerabilities
npm audit fix               # Fix vulnerabilities automatically
npm audit fix --force       # Force fixes (may break things)

License checking:

npm list --json | jq '.dependencies | to_entries | map({name: .key, license: .value.license})'

pip (Python)

Dependency Commands

List dependencies:

pip list                    # List installed packages
pip list --outdated         # Show outdated packages
pip show <package>          # Show package info

Update dependencies:

pip install --upgrade <package>  # Update specific package
pip install --upgrade -r requirements.txt  # Update from file

Security:

pip-audit                   # Check for vulnerabilities
pip-audit --fix             # Fix vulnerabilities

Freeze dependencies:

pip freeze > requirements.txt  # Generate requirements file

Poetry (Python)

Dependency Commands

List dependencies:

poetry show                 # Show installed packages
poetry show --tree          # Show dependency tree
poetry show --outdated      # Show outdated packages

Update dependencies:

poetry update               # Update all dependencies
poetry update <package>     # Update specific package
poetry add <package>@latest # Add/update to latest

Security:

poetry audit                # Check for vulnerabilities

Maven (Java)

Dependency Commands

List dependencies:

mvn dependency:tree         # Show dependency tree
mvn versions:display-dependency-updates  # Show outdated
mvn dependency:list         # List all dependencies

Update dependencies:

mvn versions:use-latest-versions  # Update to latest
mvn versions:use-latest-releases  # Update to latest releases

Security:

mvn org.owasp:dependency-check-maven:check  # OWASP check

Gradle (Java/Kotlin)

Dependency Commands

List dependencies:

./gradlew dependencies      # Show dependency tree
./gradlew dependencyUpdates # Show outdated dependencies

Update dependencies:

./gradlew dependencyUpdates --refresh-dependencies

Security:

./gradlew dependencyCheckAnalyze  # OWASP check

Cargo (Rust)

Dependency Commands

List dependencies:

cargo tree                 # Show dependency tree
cargo outdated             # Show outdated packages

Update dependencies:

cargo update                # Update Cargo.lock
cargo update <package>      # Update specific package

Common Patterns

Checking for Updates

All package managers:

Check for outdated packages regularly
Review changelogs before updating
Test updates in development first
Update incrementally

Security Scanning

Tools:

npm: npm audit
pip: pip-audit
Maven/Gradle: OWASP Dependency Check
General: Snyk, Dependabot

License Compliance

Process:

1. List all dependencies 2. Check each license 3. Verify compatibility with project license 4. Document license decisions 5. Include license file if required

Version Pinning Strategies

Exact versions:

Most secure but requires frequent updates
Use for critical dependencies

Semver ranges:

Balance between security and flexibility
Use for most dependencies

Latest:

Easiest but least secure
Use only for development dependencies

#!/usr/bin/env python3
"""Dependency parser for dependency-management skill.
Parses package.json, requirements.txt, pyproject.toml, etc.
"""

import json
import re
import sys
from pathlib import Path


def parse_package_json(file_path: Path) -> dict:
    """Parse package.json file."""
    try:
        data = json.loads(file_path.read_text())
        dependencies = {}

        # Combine all dependency types
        for dep_type in [
            "dependencies",
            "devDependencies",
            "peerDependencies",
            "optionalDependencies",
        ]:
            if dep_type in data:
                dependencies.update(data[dep_type])

        return {
            "file": str(file_path),
            "type": "npm",
            "dependencies": dependencies,
            "package_name": data.get("name", "unknown"),
            "version": data.get("version", "unknown"),
        }
    except json.JSONDecodeError as e:
        return {
            "file": str(file_path),
            "error": f"JSON parse error: {e}",
        }
    except Exception as e:
        return {
            "file": str(file_path),
            "error": f"Error: {e}",
        }


def parse_requirements_txt(file_path: Path) -> dict:
    """Parse requirements.txt file."""
    try:
        content = file_path.read_text()
        dependencies = {}

        for line in content.split("\n"):
            line = line.strip()
            if not line or line.startswith("#"):
                continue

            # Parse package==version or package>=version, etc.
            match = re.match(r"^([a-zA-Z0-9_-]+)([<>=!]+)?(.+)?$", line.split("#")[0].strip())
            if match:
                package = match.group(1)
                version = match.group(3) if match.group(3) else None
                dependencies[package] = version or "unknown"

        return {
            "file": str(file_path),
            "type": "pip",
            "dependencies": dependencies,
        }
    except Exception as e:
        return {
            "file": str(file_path),
            "error": f"Error: {e}",
        }


def parse_pyproject_toml(file_path: Path) -> dict:
    """Parse pyproject.toml file (basic parsing)."""
    try:
        content = file_path.read_text()
        dependencies = {}

        # Simple regex-based parsing for dependencies
        # This is basic - for full parsing, use tomli or tomllib
        in_dependencies = False
        for line in content.split("\n"):
            line = line.strip()
            if "dependencies" in line and "=" in line:
                in_dependencies = True
                continue
            if in_dependencies:
                if line.startswith("["):
                    break
                if line and not line.startswith("#"):
                    # Parse dependency line
                    match = re.match(r'^"([^"]+)"', line)
                    if match:
                        dep = match.group(1)
                        package = dep.split(">=")[0].split("==")[0].split("~=")[0]
                        dependencies[package] = dep

        return {
            "file": str(file_path),
            "type": "pyproject",
            "dependencies": dependencies,
        }
    except Exception as e:
        return {
            "file": str(file_path),
            "error": f"Error: {e}",
        }


def detect_and_parse(file_path: Path) -> dict:
    """Detect file type and parse accordingly."""
    file_name = file_path.name.lower()

    if file_name == "package.json":
        return parse_package_json(file_path)
    if file_name == "requirements.txt":
        return parse_requirements_txt(file_path)
    if file_name == "pyproject.toml":
        return parse_pyproject_toml(file_path)
    return {
        "file": str(file_path),
        "error": f"Unknown file type: {file_name}",
    }


def main():
    """Main entry point."""
    if len(sys.argv) < 2:
        print("Usage: parse_dependencies.py <dependency_file> [<dependency_file>...]")
        sys.exit(1)

    results = []
    for file_path_str in sys.argv[1:]:
        file_path = Path(file_path_str)
        if not file_path.exists():
            print(f"Warning: File not found: {file_path}", file=sys.stderr)
            continue

        result = detect_and_parse(file_path)
        results.append(result)

    print(json.dumps(results, indent=2))


if __name__ == "__main__":
    main()

Related skills

Azure DeploySafely execute production deployments of already-prepared applications to Microsoft Azure.485k1.3k

Azure ValidateRun deep pre-deployment checks on Azure configuration, infrastructure definitions, RBAC roles, and managed identities before pushing to production.485k1.3k

Github Actions DocsGet precise, docs-grounded answers about GitHub Actions workflows, syntax, security, and migration instead of relying on stale knowledge.275k72

Setup Pre CommitAutomatically run Prettier, type checking, and tests on every commit via Husky and lint-staged.170k199k

Deploy To VercelSafely turn any local project into a live Vercel preview with one instruction.99.3k29.7k

Vercel Cli With TokensDeploy projects to Vercel from agents and scripts using token authentication instead of interactive browser login.74.6k29.7k

FAQ

Which package managers does it handle?

npm, pip, Poetry, Maven, Gradle, and Cargo per the SKILL.md and references.

What scanning tools does it use?

npm audit, pip-audit, OWASP Dependency Check, and the Gradle Dependency Check plugin.

DevOps & CI/CDauditappsec

About

Dependency Management by the numbers

dependency-management capabilities & compatibility

What dependency-management says it does

Add your badge

What it does

Who is it for?

When should I use this skill?

What you get

By the numbers

Files

Dependency Management

When to Use This Skill

What This Skill Does

Helper Scripts

How to Use

Manage Dependencies

Specific Tasks

Management Process

1. Analyze Dependencies

2. Scan for Vulnerabilities

3. Check Licenses

4. Update Dependencies

Examples

Example 1: Vulnerability Scan

Reference Files

Best Practices

Dependency Management

Related Use Cases

Dependency Audit Report

Summary

Security Vulnerabilities

Critical

High

Medium/Low

Outdated Dependencies

Major Updates Available

Minor Updates Available

Patch Updates Available

License Compliance

License Distribution

Flagged Packages

Deprecated Packages

Unused Dependencies

Dependency Tree Issues

Duplicate Versions

Circular Dependencies

Deep Nesting (>5 levels)

Recommendations

Immediate (Security)

Short-term (Maintenance)

Long-term (Health)

Update Commands

Safe Updates (Non-breaking)

Major Updates (Review Required)

Audit Commands Used

Quality Checklist

Package Manager Reference

npm (Node.js)

Dependency Commands

pip (Python)

Dependency Commands

Poetry (Python)

Dependency Commands

Maven (Java)

Dependency Commands

Gradle (Java/Kotlin)

Dependency Commands

Cargo (Rust)

Dependency Commands

Common Patterns

Checking for Updates

Security Scanning

License Compliance

Version Pinning Strategies

Related skills

FAQ

Which package managers does it handle?

What scanning tools does it use?

This week in AI coding