Dependency Updater

by softaworks3027f20f3181MIT2.5K starsListed Oct 8, 2026Updated Oct 8, 2026Repository updated 7 months ago

Smart dependency management for any language. Auto-detects project type, applies safe updates automatically, prompts for major versions, diagnoses and fixes dependency issues.

Includes scriptsDevOps & Cloud Security

AI-generated overview

Detects a project's language and package manager, then updates dependencies safely and audits them for vulnerabilities.

What it does: The skill scans a project for package files such as package.json, requirements.txt, go.mod, Cargo.toml, Gemfile, pom.xml or .csproj to identify the language and package manager. It checks for outdated packages, auto-applies minor and patch updates, and prompts the user individually before applying major version updates. It also runs language-specific security audits, diagnoses broken or conflicting dependencies, and finishes by running the install command and reporting results.
When to use it: Use it when you want to bring a project's dependencies up to date, check for outdated packages, or resolve dependency conflicts and install errors. It is also intended for running a dependency security audit and acting on findings by severity.
Requirements: Requires the relevant language toolchains and package managers (for example npm, pip, Go, Cargo, Bundler, Maven or dotnet) plus optional update and audit tools such as taze, pip-review, pip-audit, safety, govulncheck, cargo audit or bundle audit. Network access is needed to fetch package metadata and updates. It ships two executable scripts, scripts/check-tool.sh and scripts/run-taze.sh.

Dependency Updater

Smart dependency management for any language with automatic detection and safe updates.

Quick Start

The skill auto-detects your project type and handles the rest.

Triggers

Trigger	Example
Update dependencies	"update dependencies", "update deps"
Check outdated	"check for outdated packages"
Fix dependency issues	"fix my dependency problems"
Security audit	"audit dependencies for vulnerabilities"
Diagnose deps	"diagnose dependency issues"

Supported Languages

Language	Package File	Update Tool	Audit Tool
Node.js	package.json	`taze`	`npm audit`
Python	requirements.txt, pyproject.toml	`pip-review`	`safety`, `pip-audit`
Go	go.mod	`go get -u`	`govulncheck`
Rust	Cargo.toml	`cargo update`	`cargo audit`
Ruby	Gemfile	`bundle update`	`bundle audit`
Java	pom.xml, build.gradle	`mvn versions:*`	`mvn dependency:*`
.NET	*.csproj	`dotnet outdated`	`dotnet list package --vulnerable`

Quick Reference

Workflow

User Request    │    ▼┌─────────────────────────────────────────────────────┐│ Step 1: DETECT PROJECT TYPE                         ││ • Scan for package files (package.json, go.mod...) ││ • Identify package manager                          │├─────────────────────────────────────────────────────┤│ Step 2: CHECK PREREQUISITES                         ││ • Verify required tools are installed               ││ • Suggest installation if missing                   │├─────────────────────────────────────────────────────┤│ Step 3: SCAN FOR UPDATES                            ││ • Run language-specific outdated check              ││ • Categorize: MAJOR / MINOR / PATCH / Fixed         │├─────────────────────────────────────────────────────┤│ Step 4: AUTO-APPLY SAFE UPDATES                     ││ • Apply MINOR and PATCH automatically               ││ • Report what was updated                           │├─────────────────────────────────────────────────────┤│ Step 5: PROMPT FOR MAJOR UPDATES                    ││ • AskUserQuestion for each MAJOR update             ││ • Show current → new version                        │├─────────────────────────────────────────────────────┤│ Step 6: APPLY APPROVED MAJORS                       ││ • Update only approved packages                     │├─────────────────────────────────────────────────────┤│ Step 7: FINALIZE                                    ││ • Run install command                               ││ • Run security audit                                │└─────────────────────────────────────────────────────┘

User Request    │    ▼┌─────────────────────────────────────────────────────┐│ Step 1: DETECT PROJECT TYPE                         ││ • Scan for package files (package.json, go.mod...) ││ • Identify package manager                          │├─────────────────────────────────────────────────────┤│ Step 2: CHECK PREREQUISITES                         ││ • Verify required tools are installed               ││ • Suggest installation if missing                   │├─────────────────────────────────────────────────────┤│ Step 3: SCAN FOR UPDATES                            ││ • Run language-specific outdated check              ││ • Categorize: MAJOR / MINOR / PATCH / Fixed         │├─────────────────────────────────────────────────────┤│ Step 4: AUTO-APPLY SAFE UPDATES                     ││ • Apply MINOR and PATCH automatically               ││ • Report what was updated                           │├─────────────────────────────────────────────────────┤│ Step 5: PROMPT FOR MAJOR UPDATES                    ││ • AskUserQuestion for each MAJOR update             ││ • Show current → new version                        │├─────────────────────────────────────────────────────┤│ Step 6: APPLY APPROVED MAJORS                       ││ • Update only approved packages                     │├─────────────────────────────────────────────────────┤│ Step 7: FINALIZE                                    ││ • Run install command                               ││ • Run security audit                                │└─────────────────────────────────────────────────────┘

Commands by Language

Node.js (npm/yarn/pnpm)

bash

# Check prerequisitesscripts/check-tool.sh taze "npm install -g taze"
# Scan for updatestaze
# Apply minor/patchtaze minor --write
# Apply specific majorstaze major --write --include pkg1,pkg2
# Monorepo supporttaze -r  # recursive
# Securitynpm auditnpm audit fix

# Check prerequisitesscripts/check-tool.sh taze "npm install -g taze"
# Scan for updatestaze
# Apply minor/patchtaze minor --write
# Apply specific majorstaze major --write --include pkg1,pkg2
# Monorepo supporttaze -r  # recursive
# Securitynpm auditnpm audit fix

Python

bash

# Check outdatedpip list --outdated
# Update all (careful!)pip-review --auto
# Update specificpip install --upgrade package-name
# Securitypip-auditsafety check

# Check outdatedpip list --outdated
# Update all (careful!)pip-review --auto
# Update specificpip install --upgrade package-name
# Securitypip-auditsafety check

Go

bash

# Check outdatedgo list -m -u all
# Update allgo get -u ./...
# Tidy upgo mod tidy
# Securitygovulncheck ./...

# Check outdatedgo list -m -u all
# Update allgo get -u ./...
# Tidy upgo mod tidy
# Securitygovulncheck ./...

Rust

Ruby

bash

# Check outdatedbundle outdated
# Update allbundle update
# Update specificbundle update --conservative gem-name
# Securitybundle audit

# Check outdatedbundle outdated
# Update allbundle update
# Update specificbundle update --conservative gem-name
# Securitybundle audit

Java (Maven)

bash

# Check outdatedmvn versions:display-dependency-updates
# Update to latestmvn versions:use-latest-releases
# Securitymvn dependency:treemvn dependency-check:check

# Check outdatedmvn versions:display-dependency-updates
# Update to latestmvn versions:use-latest-releases
# Securitymvn dependency:treemvn dependency-check:check

.NET

bash

# Check outdateddotnet list package --outdated
# Update specificdotnet add package PackageName
# Securitydotnet list package --vulnerable

# Check outdateddotnet list package --outdated
# Update specificdotnet add package PackageName
# Securitydotnet list package --vulnerable

Diagnosis Mode

When dependencies are broken, run diagnosis:

Common Issues & Fixes

Issue	Symptoms	Fix
Version Conflict	"Cannot resolve dependency tree"	Clean install, use overrides/resolutions
Peer Dependency	"Peer dependency not satisfied"	Install required peer version
Security Vuln	`npm audit` shows issues	`npm audit fix` or manual update
Unused Deps	Bloated bundle	Run `depcheck` (Node) or equivalent
Duplicate Deps	Multiple versions installed	Run `npm dedupe` or equivalent

Emergency Fixes

bash

# Node.js - Nuclear resetrm -rf node_modules package-lock.jsonnpm cache clean --forcenpm install
# Python - Clean virtualenvrm -rf venvpython -m venv venvsource venv/bin/activatepip install -r requirements.txt
# Go - Reset modulesrm go.sumgo mod tidy

# Node.js - Nuclear resetrm -rf node_modules package-lock.jsonnpm cache clean --forcenpm install
# Python - Clean virtualenvrm -rf venvpython -m venv venvsource venv/bin/activatepip install -r requirements.txt
# Go - Reset modulesrm go.sumgo mod tidy

Security Audit

Run security checks for any project:

bash

# Node.jsnpm auditnpm audit --json | jq '.metadata.vulnerabilities'
# Pythonpip-auditsafety check
# Gogovulncheck ./...
# Rustcargo audit
# Rubybundle audit
# .NETdotnet list package --vulnerable

# Node.jsnpm auditnpm audit --json | jq '.metadata.vulnerabilities'
# Pythonpip-auditsafety check
# Gogovulncheck ./...
# Rustcargo audit
# Rubybundle audit
# .NETdotnet list package --vulnerable

Severity Response

Anti-Patterns

Avoid	Why	Instead
Update fixed versions	Intentionally pinned	Skip them
Auto-apply MAJOR	Breaking changes	Prompt user
Batch MAJOR prompts	Loses context	Prompt individually
Skip lock file	Irreproducible builds	Always commit lock files
Ignore security alerts	Vulnerabilities	Address by severity

Verification Checklist

After updates:

<details> <summary>Deep Dive: Project Detection</summary>

The skill auto-detects project type by scanning for package files:

File Found	Language	Package Manager
`package.json`	Node.js	npm/yarn/pnpm
`requirements.txt`	Python	pip
`pyproject.toml`	Python	pip/poetry
`Pipfile`	Python	pipenv
`go.mod`	Go	go modules
`Cargo.toml`	Rust	cargo
`Gemfile`	Ruby	bundler
`pom.xml`	Java	Maven
`build.gradle`	Java/Kotlin	Gradle
`*.csproj`	.NET	dotnet

Detection order matters for monorepos:

Check current directory first
Then check for workspace/monorepo patterns
Offer to run recursively if applicable

</details> <details> <summary>Deep Dive: Node.js with taze</summary>

Prerequisites

Smart Update Flow

bash

# 1. Scan all updatestaze
# 2. Apply safe updates (minor + patch)taze minor --write
# 3. For each major, prompt user:#    "Update @types/node from ^20.0.0 to ^22.0.0?"#    If yes, add to approved list
# 4. Apply approved majorstaze major --write --include approved-pkg1,approved-pkg2
# 5. Installnpm install  # or pnpm install / yarn

# 1. Scan all updatestaze
# 2. Apply safe updates (minor + patch)taze minor --write
# 3. For each major, prompt user:#    "Update @types/node from ^20.0.0 to ^22.0.0?"#    If yes, add to approved list
# 4. Apply approved majorstaze major --write --include approved-pkg1,approved-pkg2
# 5. Installnpm install  # or pnpm install / yarn

Auto-Approve List

Some packages have frequent major bumps but are backward-compatible:

</details> <details> <summary>Deep Dive: Version Strategies</summary>

Semantic Versioning

MAJOR.MINOR.PATCH (e.g., 2.3.1)
MAJOR: Breaking changes - requires code changesMINOR: New features - backward compatiblePATCH: Bug fixes - backward compatible

MAJOR.MINOR.PATCH (e.g., 2.3.1)
MAJOR: Breaking changes - requires code changesMINOR: New features - backward compatiblePATCH: Bug fixes - backward compatible

Range Specifiers

Recommended Strategy

json

{  "dependencies": {    "critical-lib": "1.2.3",      // Exact for critical    "stable-lib": "~1.2.3",       // Patch only for stable    "modern-lib": "^1.2.3"        // Minor OK for active  }}

{  "dependencies": {    "critical-lib": "1.2.3",      // Exact for critical    "stable-lib": "~1.2.3",       // Patch only for stable    "modern-lib": "^1.2.3"        // Minor OK for active  }}

</details> <details> <summary>Deep Dive: Conflict Resolution</summary>

Node.js Conflicts

Diagnosis:

bash

npm ls package-name      # See dependency treenpm explain package-name # Why installedyarn why package-name    # Yarn equivalent

npm ls package-name      # See dependency treenpm explain package-name # Why installedyarn why package-name    # Yarn equivalent

Resolution with overrides:

Resolution with resolutions (Yarn):

Python Conflicts

Diagnosis:

Resolution:

bash

# Use virtual environmentpython -m venv venvsource venv/bin/activatepip install -r requirements.txt
# Or use constraintspip install -c constraints.txt -r requirements.txt

# Use virtual environmentpython -m venv venvsource venv/bin/activatepip install -r requirements.txt
# Or use constraintspip install -c constraints.txt -r requirements.txt

</details>

Script Reference

Related Tools

Tool	Language	Purpose
taze	Node.js	Smart dependency updates
npm-check-updates	Node.js	Alternative to taze
pip-review	Python	Interactive pip updates
cargo-edit	Rust	Cargo dependency management
bundler-audit	Ruby	Security auditing

Source and attribution

Source:softaworks/agent-toolkitinskills/dependency-updaterat commit3027f20

License: MIT

Content belongs to its original authors. SourceWeft indexes it from a public repository.

Report or request removal

Update Type	Version Change	Action
Fixed	No `^` or `~`	Skip (intentionally pinned)
PATCH	`x.y.z` → `x.y.Z`	Auto-apply
MINOR	`x.y.z` → `x.Y.0`	Auto-apply
MAJOR	`x.y.z` → `X.0.0`	Prompt user individually

Severity	Action
Critical	Fix immediately
High	Fix within 24h
Moderate	Fix within 1 week
Low	Fix in next release

Package	Reason
`lucide-react`	Icon library, majors are additive
`@types/*`	Type definitions, usually safe

Specifier	Meaning	Example
`^1.2.3`	Minor + Patch OK	`>=1.2.3 <2.0.0`
`~1.2.3`	Patch only	`>=1.2.3 <1.3.0`
`1.2.3`	Exact (fixed)	Only `1.2.3`
`>=1.2.3`	At least	Any `>=1.2.3`
`*`	Any	Latest (dangerous)

Script	Purpose
`scripts/check-tool.sh`	Verify tool is installed
`scripts/run-taze.sh`	Run taze with proper flags

Dependency Updater

Dependency Updater

Quick Start

Triggers

Supported Languages

Quick Reference

Workflow

Commands by Language

Node.js (npm/yarn/pnpm)

Python

Go

Rust

Ruby

Java (Maven)

.NET

Diagnosis Mode

Common Issues & Fixes

Emergency Fixes

Security Audit

Severity Response

Anti-Patterns

Verification Checklist

Prerequisites

Smart Update Flow

Auto-Approve List

Semantic Versioning

Range Specifiers

Recommended Strategy

Node.js Conflicts

Python Conflicts

Script Reference

Related Tools

Source and attribution

More from softaworks/agent-toolkit

Writing Clearly And Concisely

Web To Markdown

Skill Judge

Ship Learn Next

Reducing Entropy

Qa Test Planner

More in DevOps & Cloud

M5 Onboard

Yeet

Runbook

Incident Response

Deploy Checklist

Spanner Basics