Dependency Updater

# Dependency Updater

Smart dependency management for any programming language with automatic detection and safe updates.

## Purpose

The Dependency Updater skill provides intelligent, language-agnostic dependency management that:

- **Auto-detects your project type** by scanning for package files (package.json, go.mod, Cargo.toml, etc.)
- **Applies safe updates automatically** (minor and patch versions)
- **Prompts for major updates individually** to prevent breaking changes
- **Respects intentionally pinned versions** by skipping fixed dependencies
- **Runs security audits** to identify vulnerabilities
- **Diagnoses and fixes** common dependency issues

This skill eliminates the manual work of checking for outdated packages across different ecosystems while maintaining safety through semantic versioning awareness.

## When to Use

Use this skill when you want to:

| Scenario | Trigger Phrases |
|----------|-----------------|
| Update dependencies | "update dependencies", "update deps", "update my packages" |
| Check for outdated packages | "check for outdated packages", "what packages need updating" |
| Fix dependency problems | "fix my dependency problems", "resolve dependency conflicts" |
| Security audit | "audit dependencies for vulnerabilities", "check for security issues" |
| Diagnose issues | "diagnose dependency issues", "why won't my dependencies install" |

**Quick Start:**
```
update my dependencies
```

The skill will auto-detect your project type and handle everything.

## Supported Languages

| Language | Package File | Update Tool | Audit Tool |
|----------|--------------|-------------|------------|
| Node.js | package.json | `taze` | `npm audit` |
| Python | requirements.txt, pyproject.toml, Pipfile | `pip-review` | `safety`, `pip-audit` |
| Go | go.mod | `go get -u` | `govulncheck` |
| Rust | Cargo.toml | `cargo update` | `cargo audit` |
| Ruby | Gemfile | `bundle update` | `bundle audit` |
| Java | pom.xml, build.gradle | `mvn versions:*` | `mvn dependency-check:check` |
| .NET | *.csproj | `dotnet outdated` | `dotnet list package --vulnerable` |

## How It Works

The skill follows a systematic 7-step workflow:

```
1. DETECT PROJECT TYPE
   Scan for package files and identify the package manager

2. CHECK PREREQUISITES
   Verify required tools are installed, suggest installation if missing

3. SCAN FOR UPDATES
   Run language-specific outdated checks and categorize updates

4. AUTO-APPLY SAFE UPDATES
   Automatically apply MINOR and PATCH updates

5. PROMPT FOR MAJOR UPDATES
   Ask user about each MAJOR update individually (breaking changes)

6. APPLY APPROVED MAJORS
   Update only the packages the user approved

7. FINALIZE
   Run install command and security audit
```

### Update Classification

| Update Type | Version Change | Action |
|-------------|----------------|--------|
| **Fixed** | No `^` or `~` prefix | Skip (intentionally pinned) |
| **PATCH** | `1.2.3` to `1.2.4` | Auto-apply |
| **MINOR** | `1.2.3` to `1.3.0` | Auto-apply |
| **MAJOR** | `1.2.3` to `2.0.0` | Prompt user individually |

## Key Features

### Language-Agnostic Detection

The skill automatically identifies your project by scanning for common package files:

- `package.json` - Node.js (npm/yarn/pnpm)
- `requirements.txt` / `pyproject.toml` / `Pipfile` - Python
- `go.mod` - Go
- `Cargo.toml` - Rust
- `Gemfile` - Ruby
- `pom.xml` / `build.gradle` - Java/Kotlin
- `*.csproj` - .NET

### Safe-by-Default Updates

- Minor and patch updates are applied automatically (backward compatible)
- Major updates require explicit approval (may contain breaking changes)
- Fixed/pinned versions are never modified

### Security Auditing

Built-in security vulnerability scanning for each ecosystem:
- Identifies vulnerabilities by severity (Critical, High, Moderate, Low)
- Recommends appropriate response times based on severity
- Integrates with ecosystem-specific audit tools

### Dependency Diagnosis

Troubleshoots common issues:
- Version conflicts