Dependency Updater

Dependency Updater

Smart dependency management for any language with automatic detection and safe updates.

---

Quick Start

update my dependencies

The skill auto-detects your project type and handles the rest.

---

Triggers

---

Supported Languages

---

Quick Reference

---

Workflow

User Request
    │
    ▼
┌─────────────────────────────────────────────────────┐
│ Step 1: DETECT PROJECT TYPE                         │
│ • Scan for package files (package.json, go.mod...) │
│ • Identify package manager                          │
├─────────────────────────────────────────────────────┤
│ Step 2: CHECK PREREQUISITES                         │
│ • Verify required tools are installed               │
│ • Suggest installation if missing                   │
├─────────────────────────────────────────────────────┤
│ Step 3: SCAN FOR UPDATES                            │
│ • Run language-specific outdated check              │
│ • Categorize: MAJOR / MINOR / PATCH / Fixed         │
├─────────────────────────────────────────────────────┤
│ Step 4: AUTO-APPLY SAFE UPDATES                     │
│ • Apply MINOR and PATCH automatically               │
│ • Report what was updated                           │
├─────────────────────────────────────────────────────┤
│ Step 5: PROMPT FOR MAJOR UPDATES                    │
│ • AskUserQuestion for each MAJOR update             │
│ • Show current → new version                        │
├─────────────────────────────────────────────────────┤
│ Step 6: APPLY APPROVED MAJORS                       │
│ • Update only approved packages                     │
├─────────────────────────────────────────────────────┤
│ Step 7: FINALIZE                                    │
│ • Run install command                               │
│ • Run security audit                                │
└─────────────────────────────────────────────────────┘

---

Commands by Language

Node.js (npm/yarn/pnpm)

# Check prerequisites
scripts/check-tool.sh taze "npm install -g taze"

# Scan for updates
taze

# Apply minor/patch
taze minor --write

# Apply specific majors
taze major --write --include pkg1,pkg2

# Monorepo support
taze -r  # recursive

# Security
npm audit
npm audit fix

Python

# Check outdated
pip list --outdated

# Update all (careful!)
pip-review --auto

# Update specific
pip install --upgrade package-name

# Security
pip-audit
safety check

Go

# Check outdated
go list -m -u all

# Update all
go get -u ./...

# Tidy up
go mod tidy

# Security
govulncheck ./...

Rust

# Check outdated
cargo outdated

# Update within semver
cargo update

# Security
cargo audit

Ruby

# Check outdated
bundle outdated

# Update all
bundle update

# Update specific
bundle update --conservative gem-name

# Security
bundle audit

Java (Maven)

# Check outdated
mvn versions:display-dependency-updates

# Update to latest
mvn versions:use-latest-releases

# Security
mvn dependency:tree
mvn dependency-check:check

.NET

# Check outdated
dotnet list package --outdated

# Update specific
dotnet add package PackageName

# Security
dotnet list package --vulnerable

---

Diagnosis Mode

When dependencies are broken, run diagnosis:

Common Issues & Fixes

Emergency Fixes

# Node.js - Nuclear reset
rm -rf node_modules package-lock.json
npm cache clean --force
npm install

# Python - Clean virtualenv
rm -rf venv
python -m venv venv
source venv/bin/activate
pip install -r requirements.txt

# Go - Reset modules
rm go.sum
go mod tidy

---

Security Audit

Run security checks for any project:

# Node.js
npm audit
npm audit --json | jq '.metadata.vulnerabilities'

# Python
pip-audit
safety check

# Go
govulncheck ./...

# Rust
cargo audit

# Ruby
bundle audit

# .NET
dotnet list package --vulnerable

Severity Response

---

Anti-Patterns

---

Verification Checklist

After updates:

• [ ] Updates scanned without errors
• [ ] MINOR/PATCH auto-applied
• [ ] MAJOR updates prompted individually
• [ ] Fixed versions untouched
• [ ] Lock file updated
• [ ] Install command ran
• [ ] Security audit passed (or issues noted)

---

<details> <summary><strong>Deep Dive: Project Detection</strong></summary>

The skill auto-detects project type by scanning for package files:

Detection order matters for monorepos: 1. Check current directory first 2. Then check for workspace/monorepo patterns 3. Offer to run recursively if applicable

</details>

<details> <summary><strong>Deep Dive: Node.js with taze</strong></summary>

Prerequisites

# Install taze globally (recommended)
npm install -g taze

# Or use npx
npx taze

Smart Update Flow

# 1. Scan all updates
taze

# 2. Apply safe updates (minor + patch)
taze minor --write

# 3. For each major, prompt user:
#    "Update @types/node from ^20.0.0 to ^22.0.0?"
#    If yes, add to approved list

# 4. Apply approved majors
taze major --write --include approved-pkg1,approved-pkg2

# 5. Install
npm install  # or pnpm install / yarn

Auto-Approve List

Some packages have frequent major bumps but are backward-compatible:

</details>

<details> <summary><strong>Deep Dive: Version Strategies</strong></summary>

Semantic Versioning

MAJOR.MINOR.PATCH (e.g., 2.3.1)

MAJOR: Breaking changes - requires code changes
MINOR: New features - backward compatible
PATCH: Bug fixes - backward compatible

Range Specifiers

Recommended Strategy

{
  "dependencies": {
    "critical-lib": "1.2.3",      // Exact for critical
    "stable-lib": "~1.2.3",       // Patch only for stable
    "modern-lib": "^1.2.3"        // Minor OK for active
  }
}

</details>

<details> <summary><strong>Deep Dive: Conflict Resolution</strong></summary>

Node.js Conflicts

Diagnosis:

npm ls package-name      # See dependency tree
npm explain package-name # Why installed
yarn why package-name    # Yarn equivalent

Resolution with overrides:

// package.json
{
  "overrides": {
    "lodash": "^4.18.0"
  }
}

Resolution with resolutions (Yarn):

{
  "resolutions": {
    "lodash": "^4.18.0"
  }
}

Python Conflicts

Diagnosis:

pip check
pipdeptree -p package-name

Resolution:

# Use virtual environment
python -m venv venv
source venv/bin/activate
pip install -r requirements.txt

# Or use constraints
pip install -c constraints.txt -r requirements.txt

</details>

---

Script Reference

---

Related Tools

Dependency Updater

Smart dependency management for any programming language with automatic detection and safe updates.

Purpose

The Dependency Updater skill provides intelligent, language-agnostic dependency management that:

• Auto-detects your project type by scanning for package files (package.json, go.mod, Cargo.toml, etc.)
• Applies safe updates automatically (minor and patch versions)
• Prompts for major updates individually to prevent breaking changes
• Respects intentionally pinned versions by skipping fixed dependencies
• Runs security audits to identify vulnerabilities
• Diagnoses and fixes common dependency issues

This skill eliminates the manual work of checking for outdated packages across different ecosystems while maintaining safety through semantic versioning awareness.

When to Use

Use this skill when you want to:

Quick Start:

update my dependencies

The skill will auto-detect your project type and handle everything.

Supported Languages

How It Works

The skill follows a systematic 7-step workflow:

1. DETECT PROJECT TYPE
   Scan for package files and identify the package manager

2. CHECK PREREQUISITES
   Verify required tools are installed, suggest installation if missing

3. SCAN FOR UPDATES
   Run language-specific outdated checks and categorize updates

4. AUTO-APPLY SAFE UPDATES
   Automatically apply MINOR and PATCH updates

5. PROMPT FOR MAJOR UPDATES
   Ask user about each MAJOR update individually (breaking changes)

6. APPLY APPROVED MAJORS
   Update only the packages the user approved

7. FINALIZE
   Run install command and security audit

Update Classification

Key Features

Language-Agnostic Detection

The skill automatically identifies your project by scanning for common package files:

• package.json - Node.js (npm/yarn/pnpm)
• requirements.txt / pyproject.toml / Pipfile - Python
• go.mod - Go
• Cargo.toml - Rust
• Gemfile - Ruby
• pom.xml / build.gradle - Java/Kotlin
• *.csproj - .NET

Safe-by-Default Updates

• Minor and patch updates are applied automatically (backward compatible)
• Major updates require explicit approval (may contain breaking changes)
• Fixed/pinned versions are never modified

Security Auditing

Built-in security vulnerability scanning for each ecosystem:

• Identifies vulnerabilities by severity (Critical, High, Moderate, Low)
• Recommends appropriate response times based on severity
• Integrates with ecosystem-specific audit tools

Dependency Diagnosis

Troubleshoots common issues:

• Version conflicts
• Peer dependency problems
• Security vulnerabilities
• Unused dependencies
• Duplicate packages

Usage Examples

Basic Update

update my dependencies

The skill will scan your project, apply safe updates, and prompt for major versions.

Security-Focused Audit

audit my dependencies for security issues

Runs security scanners and reports vulnerabilities by severity.

Diagnose Problems

my npm install keeps failing, diagnose the issue

Analyzes dependency tree, identifies conflicts, and suggests fixes.

Node.js Specific

# Check prerequisites
scripts/check-tool.sh taze "npm install -g taze"

# Run taze directly
scripts/run-taze.sh

# Run in monorepo mode
scripts/run-taze.sh -r

Prerequisites

General Requirements

Each language ecosystem requires its standard package manager:

• Node.js: npm, yarn, or pnpm
• Python: pip
• Go: go modules
• Rust: cargo
• Ruby: bundler
• Java: Maven or Gradle
• .NET: dotnet CLI

Recommended Tools

For the best experience, install these optional but recommended tools:

Output

Update Summary

After running, you will see:

• List of auto-applied minor/patch updates
• Prompts for each major update decision
• Final package count and versions
• Security audit results

Security Audit Results

Vulnerabilities are reported with severity levels:

Best Practices

Do

• Commit lock files - Always commit package-lock.json, yarn.lock, go.sum, etc.
• Review major updates - Check changelogs before approving major version bumps
• Run tests after updates - Verify your application still works
• Address security issues promptly - Prioritize by severity level
• Use version ranges appropriately - ^ for active libraries, ~ for stable ones, exact for critical dependencies

Avoid

• Don't auto-approve all majors - Breaking changes require code modifications
• Don't ignore security alerts - Vulnerabilities can be exploited
• Don't update fixed versions - They were pinned for a reason
• Don't skip the lock file - It ensures reproducible builds

Version Range Strategy

{
  "dependencies": {
    "critical-lib": "1.2.3",      // Exact for critical dependencies
    "stable-lib": "~1.2.3",       // Patch only for stable libraries
    "modern-lib": "^1.2.3"        // Minor OK for actively maintained
  }
}

Emergency Fixes

When dependencies are completely broken:

Node.js - Nuclear Reset

rm -rf node_modules package-lock.json
npm cache clean --force
npm install

Python - Clean Virtual Environment

rm -rf venv
python -m venv venv
source venv/bin/activate
pip install -r requirements.txt

Go - Reset Modules

rm go.sum
go mod tidy

Verification Checklist

After running updates, verify:

• [ ] Updates scanned without errors
• [ ] Minor/patch updates auto-applied
• [ ] Major updates prompted individually
• [ ] Fixed versions remained untouched
• [ ] Lock file updated
• [ ] Install command succeeded
• [ ] Security audit passed (or issues noted)
• [ ] Tests pass
• [ ] Application runs correctly

Related Tools

License

MIT