Dependency Updater

作者 softaworks3027f20f3181MIT2.5K 个星标收录于 2026年10月8日更新于 2026年10月8日仓库7个月前更新

Smart dependency management for any language. Auto-detects project type, applies safe updates automatically, prompts for major versions, diagnoses and fixes dependency issues.

包含脚本DevOps & Cloud Security

AI 生成的概览

自动识别项目语言与包管理器，安全更新依赖并执行漏洞审计。

功能: 该技能会扫描项目中的包文件（如 package.json、requirements.txt、go.mod、Cargo.toml、Gemfile、pom.xml 或 .csproj），以判断所用语言与包管理器。它会检查过期的依赖包，自动应用次版本与补丁版本更新，并在应用主版本更新前逐个向用户确认。它还会运行针对各语言的安全审计、诊断依赖冲突或损坏问题，最后执行安装命令并汇报结果。
适用场景: 适用于需要将项目依赖升级到最新版本、检查过期依赖包，或解决依赖冲突与安装错误的场景。也适合执行依赖安全审计并按严重程度处理发现的问题。
运行要求: 需要相应的语言工具链与包管理器（例如 npm、pip、Go、Cargo、Bundler、Maven 或 dotnet），以及可选的更新与审计工具，如 taze、pip-review、pip-audit、safety、govulncheck、cargo audit 或 bundle audit。需要网络访问以获取包元数据与更新。技能附带两个可执行脚本：scripts/check-tool.sh 与 scripts/run-taze.sh。

Dependency Updater

Smart dependency management for any language with automatic detection and safe updates.

Quick Start

The skill auto-detects your project type and handles the rest.

Triggers

Trigger	Example
Update dependencies	"update dependencies", "update deps"
Check outdated	"check for outdated packages"
Fix dependency issues	"fix my dependency problems"
Security audit	"audit dependencies for vulnerabilities"
Diagnose deps	"diagnose dependency issues"

Supported Languages

Language	Package File	Update Tool	Audit Tool
Node.js	package.json	`taze`	`npm audit`
Python	requirements.txt, pyproject.toml	`pip-review`	`safety`, `pip-audit`
Go	go.mod	`go get -u`	`govulncheck`
Rust	Cargo.toml	`cargo update`	`cargo audit`
Ruby	Gemfile	`bundle update`	`bundle audit`
Java	pom.xml, build.gradle	`mvn versions:*`	`mvn dependency:*`
.NET	*.csproj	`dotnet outdated`	`dotnet list package --vulnerable`

Quick Reference

Workflow

User Request    │    ▼┌─────────────────────────────────────────────────────┐│ Step 1: DETECT PROJECT TYPE                         ││ • Scan for package files (package.json, go.mod...) ││ • Identify package manager                          │├─────────────────────────────────────────────────────┤│ Step 2: CHECK PREREQUISITES                         ││ • Verify required tools are installed               ││ • Suggest installation if missing                   │├─────────────────────────────────────────────────────┤│ Step 3: SCAN FOR UPDATES                            ││ • Run language-specific outdated check              ││ • Categorize: MAJOR / MINOR / PATCH / Fixed         │├─────────────────────────────────────────────────────┤│ Step 4: AUTO-APPLY SAFE UPDATES                     ││ • Apply MINOR and PATCH automatically               ││ • Report what was updated                           │├─────────────────────────────────────────────────────┤│ Step 5: PROMPT FOR MAJOR UPDATES                    ││ • AskUserQuestion for each MAJOR update             ││ • Show current → new version                        │├─────────────────────────────────────────────────────┤│ Step 6: APPLY APPROVED MAJORS                       ││ • Update only approved packages                     │├─────────────────────────────────────────────────────┤│ Step 7: FINALIZE                                    ││ • Run install command                               ││ • Run security audit                                │└─────────────────────────────────────────────────────┘

User Request    │    ▼┌─────────────────────────────────────────────────────┐│ Step 1: DETECT PROJECT TYPE                         ││ • Scan for package files (package.json, go.mod...) ││ • Identify package manager                          │├─────────────────────────────────────────────────────┤│ Step 2: CHECK PREREQUISITES                         ││ • Verify required tools are installed               ││ • Suggest installation if missing                   │├─────────────────────────────────────────────────────┤│ Step 3: SCAN FOR UPDATES                            ││ • Run language-specific outdated check              ││ • Categorize: MAJOR / MINOR / PATCH / Fixed         │├─────────────────────────────────────────────────────┤│ Step 4: AUTO-APPLY SAFE UPDATES                     ││ • Apply MINOR and PATCH automatically               ││ • Report what was updated                           │├─────────────────────────────────────────────────────┤│ Step 5: PROMPT FOR MAJOR UPDATES                    ││ • AskUserQuestion for each MAJOR update             ││ • Show current → new version                        │├─────────────────────────────────────────────────────┤│ Step 6: APPLY APPROVED MAJORS                       ││ • Update only approved packages                     │├─────────────────────────────────────────────────────┤│ Step 7: FINALIZE                                    ││ • Run install command                               ││ • Run security audit                                │└─────────────────────────────────────────────────────┘

Commands by Language

Node.js (npm/yarn/pnpm)

bash

# Check prerequisitesscripts/check-tool.sh taze "npm install -g taze"
# Scan for updatestaze
# Apply minor/patchtaze minor --write
# Apply specific majorstaze major --write --include pkg1,pkg2
# Monorepo supporttaze -r  # recursive
# Securitynpm auditnpm audit fix

# Check prerequisitesscripts/check-tool.sh taze "npm install -g taze"
# Scan for updatestaze
# Apply minor/patchtaze minor --write
# Apply specific majorstaze major --write --include pkg1,pkg2
# Monorepo supporttaze -r  # recursive
# Securitynpm auditnpm audit fix

Python

bash

# Check outdatedpip list --outdated
# Update all (careful!)pip-review --auto
# Update specificpip install --upgrade package-name
# Securitypip-auditsafety check

# Check outdatedpip list --outdated
# Update all (careful!)pip-review --auto
# Update specificpip install --upgrade package-name
# Securitypip-auditsafety check

Go

bash

# Check outdatedgo list -m -u all
# Update allgo get -u ./...
# Tidy upgo mod tidy
# Securitygovulncheck ./...

# Check outdatedgo list -m -u all
# Update allgo get -u ./...
# Tidy upgo mod tidy
# Securitygovulncheck ./...

Rust

Ruby

bash

# Check outdatedbundle outdated
# Update allbundle update
# Update specificbundle update --conservative gem-name
# Securitybundle audit

# Check outdatedbundle outdated
# Update allbundle update
# Update specificbundle update --conservative gem-name
# Securitybundle audit

Java (Maven)

bash

# Check outdatedmvn versions:display-dependency-updates
# Update to latestmvn versions:use-latest-releases
# Securitymvn dependency:treemvn dependency-check:check

# Check outdatedmvn versions:display-dependency-updates
# Update to latestmvn versions:use-latest-releases
# Securitymvn dependency:treemvn dependency-check:check

.NET

bash

# Check outdateddotnet list package --outdated
# Update specificdotnet add package PackageName
# Securitydotnet list package --vulnerable

# Check outdateddotnet list package --outdated
# Update specificdotnet add package PackageName
# Securitydotnet list package --vulnerable

Diagnosis Mode

When dependencies are broken, run diagnosis:

Common Issues & Fixes

Issue	Symptoms	Fix
Version Conflict	"Cannot resolve dependency tree"	Clean install, use overrides/resolutions
Peer Dependency	"Peer dependency not satisfied"	Install required peer version
Security Vuln	`npm audit` shows issues	`npm audit fix` or manual update
Unused Deps	Bloated bundle	Run `depcheck` (Node) or equivalent
Duplicate Deps	Multiple versions installed	Run `npm dedupe` or equivalent

Emergency Fixes

bash

# Node.js - Nuclear resetrm -rf node_modules package-lock.jsonnpm cache clean --forcenpm install
# Python - Clean virtualenvrm -rf venvpython -m venv venvsource venv/bin/activatepip install -r requirements.txt
# Go - Reset modulesrm go.sumgo mod tidy

# Node.js - Nuclear resetrm -rf node_modules package-lock.jsonnpm cache clean --forcenpm install
# Python - Clean virtualenvrm -rf venvpython -m venv venvsource venv/bin/activatepip install -r requirements.txt
# Go - Reset modulesrm go.sumgo mod tidy

Security Audit

Run security checks for any project:

bash

# Node.jsnpm auditnpm audit --json | jq '.metadata.vulnerabilities'
# Pythonpip-auditsafety check
# Gogovulncheck ./...
# Rustcargo audit
# Rubybundle audit
# .NETdotnet list package --vulnerable

# Node.jsnpm auditnpm audit --json | jq '.metadata.vulnerabilities'
# Pythonpip-auditsafety check
# Gogovulncheck ./...
# Rustcargo audit
# Rubybundle audit
# .NETdotnet list package --vulnerable

Severity Response

Anti-Patterns

Avoid	Why	Instead
Update fixed versions	Intentionally pinned	Skip them
Auto-apply MAJOR	Breaking changes	Prompt user
Batch MAJOR prompts	Loses context	Prompt individually
Skip lock file	Irreproducible builds	Always commit lock files
Ignore security alerts	Vulnerabilities	Address by severity

Verification Checklist

After updates:

<details> <summary>Deep Dive: Project Detection</summary>

The skill auto-detects project type by scanning for package files:

File Found	Language	Package Manager
`package.json`	Node.js	npm/yarn/pnpm
`requirements.txt`	Python	pip
`pyproject.toml`	Python	pip/poetry
`Pipfile`	Python	pipenv
`go.mod`	Go	go modules
`Cargo.toml`	Rust	cargo
`Gemfile`	Ruby	bundler
`pom.xml`	Java	Maven
`build.gradle`	Java/Kotlin	Gradle
`*.csproj`	.NET	dotnet

Detection order matters for monorepos:

Check current directory first
Then check for workspace/monorepo patterns
Offer to run recursively if applicable

</details> <details> <summary>Deep Dive: Node.js with taze</summary>

Prerequisites

Smart Update Flow

bash

# 1. Scan all updatestaze
# 2. Apply safe updates (minor + patch)taze minor --write
# 3. For each major, prompt user:#    "Update @types/node from ^20.0.0 to ^22.0.0?"#    If yes, add to approved list
# 4. Apply approved majorstaze major --write --include approved-pkg1,approved-pkg2
# 5. Installnpm install  # or pnpm install / yarn

# 1. Scan all updatestaze
# 2. Apply safe updates (minor + patch)taze minor --write
# 3. For each major, prompt user:#    "Update @types/node from ^20.0.0 to ^22.0.0?"#    If yes, add to approved list
# 4. Apply approved majorstaze major --write --include approved-pkg1,approved-pkg2
# 5. Installnpm install  # or pnpm install / yarn

Auto-Approve List

Some packages have frequent major bumps but are backward-compatible:

</details> <details> <summary>Deep Dive: Version Strategies</summary>

Semantic Versioning

MAJOR.MINOR.PATCH (e.g., 2.3.1)
MAJOR: Breaking changes - requires code changesMINOR: New features - backward compatiblePATCH: Bug fixes - backward compatible

MAJOR.MINOR.PATCH (e.g., 2.3.1)
MAJOR: Breaking changes - requires code changesMINOR: New features - backward compatiblePATCH: Bug fixes - backward compatible

Range Specifiers

Recommended Strategy

json

{  "dependencies": {    "critical-lib": "1.2.3",      // Exact for critical    "stable-lib": "~1.2.3",       // Patch only for stable    "modern-lib": "^1.2.3"        // Minor OK for active  }}

{  "dependencies": {    "critical-lib": "1.2.3",      // Exact for critical    "stable-lib": "~1.2.3",       // Patch only for stable    "modern-lib": "^1.2.3"        // Minor OK for active  }}

</details> <details> <summary>Deep Dive: Conflict Resolution</summary>

Node.js Conflicts

Diagnosis:

bash

npm ls package-name      # See dependency treenpm explain package-name # Why installedyarn why package-name    # Yarn equivalent

npm ls package-name      # See dependency treenpm explain package-name # Why installedyarn why package-name    # Yarn equivalent

Resolution with overrides:

Resolution with resolutions (Yarn):

Python Conflicts

Diagnosis:

Resolution:

bash

# Use virtual environmentpython -m venv venvsource venv/bin/activatepip install -r requirements.txt
# Or use constraintspip install -c constraints.txt -r requirements.txt

# Use virtual environmentpython -m venv venvsource venv/bin/activatepip install -r requirements.txt
# Or use constraintspip install -c constraints.txt -r requirements.txt

</details>

Script Reference

Related Tools

Tool	Language	Purpose
taze	Node.js	Smart dependency updates
npm-check-updates	Node.js	Alternative to taze
pip-review	Python	Interactive pip updates
cargo-edit	Rust	Cargo dependency management
bundler-audit	Ruby	Security auditing

来源与署名

来源：softaworks/agent-toolkit位于skills/dependency-updater提交3027f20

许可证： MIT

内容归原作者所有。SourceWeft 从公开仓库中收录这些内容。

举报或申请下架

Update Type	Version Change	Action
Fixed	No `^` or `~`	Skip (intentionally pinned)
PATCH	`x.y.z` → `x.y.Z`	Auto-apply
MINOR	`x.y.z` → `x.Y.0`	Auto-apply
MAJOR	`x.y.z` → `X.0.0`	Prompt user individually

Severity	Action
Critical	Fix immediately
High	Fix within 24h
Moderate	Fix within 1 week
Low	Fix in next release

Package	Reason
`lucide-react`	Icon library, majors are additive
`@types/*`	Type definitions, usually safe

Specifier	Meaning	Example
`^1.2.3`	Minor + Patch OK	`>=1.2.3 <2.0.0`
`~1.2.3`	Patch only	`>=1.2.3 <1.3.0`
`1.2.3`	Exact (fixed)	Only `1.2.3`
`>=1.2.3`	At least	Any `>=1.2.3`
`*`	Any	Latest (dangerous)

Script	Purpose
`scripts/check-tool.sh`	Verify tool is installed
`scripts/run-taze.sh`	Run taze with proper flags

Dependency Updater

Dependency Updater

Quick Start

Triggers

Supported Languages

Quick Reference

Workflow

Commands by Language

Node.js (npm/yarn/pnpm)

Python

Go

Rust

Ruby

Java (Maven)

.NET

Diagnosis Mode

Common Issues & Fixes

Emergency Fixes

Security Audit

Severity Response

Anti-Patterns

Verification Checklist

Prerequisites

Smart Update Flow

Auto-Approve List

Semantic Versioning

Range Specifiers

Recommended Strategy

Node.js Conflicts

Python Conflicts

Script Reference

Related Tools

来源与署名

更多来自 softaworks/agent-toolkit 的技能

C4 Architecture

Writing Clearly And Concisely

Web To Markdown

Skill Judge

Ship Learn Next

Reducing Entropy

更多DevOps & Cloud技能

Playwright Devops

M5 Onboard

Yeet

Runbook

Incident Response

Deploy Checklist