Dependency Updater

softaworks/agent-toolkit/skills/dependency-updater

作者 softaworks3027f20f3181MIT2.5K 個星標收錄於 2026年10月8日更新於 2026年10月8日儲存庫7 個月前更新

Smart dependency management for any language. Auto-detects project type, applies safe updates automatically, prompts for major versions, diagnoses and fixes dependency issues.

包含腳本DevOps & Cloud Security

AI 產生的概覽

自動辨識專案語言與套件管理器，安全更新相依套件並執行弱點稽核。

功能: 此技能會掃描專案中的套件檔案（例如 package.json、requirements.txt、go.mod、Cargo.toml、Gemfile、pom.xml 或 .csproj），以判斷使用的語言與套件管理器。它會檢查過期的套件，自動套用次版本與修補版本更新，並在套用主版本更新前逐一詢問使用者。它也會執行各語言專屬的安全性稽核、診斷相依性衝突或損毀問題，最後執行安裝指令並回報結果。
適用情境: 適用於需要將專案相依套件升級至最新版本、檢查過期套件，或解決相依性衝突與安裝錯誤的情況。也適合執行相依套件安全性稽核，並依嚴重程度處理發現的問題。
執行需求: 需要對應的語言工具鏈與套件管理器（例如 npm、pip、Go、Cargo、Bundler、Maven 或 dotnet），以及選用的更新與稽核工具，如 taze、pip-review、pip-audit、safety、govulncheck、cargo audit 或 bundle audit。需要網路存取以取得套件中介資料與更新。技能附帶兩個可執行指令碼：scripts/check-tool.sh 與 scripts/run-taze.sh。

Dependency Updater

Smart dependency management for any language with automatic detection and safe updates.

Quick Start

The skill auto-detects your project type and handles the rest.

Triggers

Trigger	Example
Update dependencies	"update dependencies", "update deps"
Check outdated	"check for outdated packages"
Fix dependency issues	"fix my dependency problems"
Security audit	"audit dependencies for vulnerabilities"
Diagnose deps	"diagnose dependency issues"

Supported Languages

Language	Package File	Update Tool	Audit Tool
Node.js	package.json	`taze`	`npm audit`
Python	requirements.txt, pyproject.toml	`pip-review`	`safety`, `pip-audit`
Go	go.mod	`go get -u`	`govulncheck`
Rust	Cargo.toml	`cargo update`	`cargo audit`
Ruby	Gemfile	`bundle update`	`bundle audit`
Java	pom.xml, build.gradle	`mvn versions:*`	`mvn dependency:*`
.NET	*.csproj	`dotnet outdated`	`dotnet list package --vulnerable`

Quick Reference

Workflow

User Request    │    ▼┌─────────────────────────────────────────────────────┐│ Step 1: DETECT PROJECT TYPE                         ││ • Scan for package files (package.json, go.mod...) ││ • Identify package manager                          │├─────────────────────────────────────────────────────┤│ Step 2: CHECK PREREQUISITES                         ││ • Verify required tools are installed               ││ • Suggest installation if missing                   │├─────────────────────────────────────────────────────┤│ Step 3: SCAN FOR UPDATES                            ││ • Run language-specific outdated check              ││ • Categorize: MAJOR / MINOR / PATCH / Fixed         │├─────────────────────────────────────────────────────┤│ Step 4: AUTO-APPLY SAFE UPDATES                     ││ • Apply MINOR and PATCH automatically               ││ • Report what was updated                           │├─────────────────────────────────────────────────────┤│ Step 5: PROMPT FOR MAJOR UPDATES                    ││ • AskUserQuestion for each MAJOR update             ││ • Show current → new version                        │├─────────────────────────────────────────────────────┤│ Step 6: APPLY APPROVED MAJORS                       ││ • Update only approved packages                     │├─────────────────────────────────────────────────────┤│ Step 7: FINALIZE                                    ││ • Run install command                               ││ • Run security audit                                │└─────────────────────────────────────────────────────┘

User Request    │    ▼┌─────────────────────────────────────────────────────┐│ Step 1: DETECT PROJECT TYPE                         ││ • Scan for package files (package.json, go.mod...) ││ • Identify package manager                          │├─────────────────────────────────────────────────────┤│ Step 2: CHECK PREREQUISITES                         ││ • Verify required tools are installed               ││ • Suggest installation if missing                   │├─────────────────────────────────────────────────────┤│ Step 3: SCAN FOR UPDATES                            ││ • Run language-specific outdated check              ││ • Categorize: MAJOR / MINOR / PATCH / Fixed         │├─────────────────────────────────────────────────────┤│ Step 4: AUTO-APPLY SAFE UPDATES                     ││ • Apply MINOR and PATCH automatically               ││ • Report what was updated                           │├─────────────────────────────────────────────────────┤│ Step 5: PROMPT FOR MAJOR UPDATES                    ││ • AskUserQuestion for each MAJOR update             ││ • Show current → new version                        │├─────────────────────────────────────────────────────┤│ Step 6: APPLY APPROVED MAJORS                       ││ • Update only approved packages                     │├─────────────────────────────────────────────────────┤│ Step 7: FINALIZE                                    ││ • Run install command                               ││ • Run security audit                                │└─────────────────────────────────────────────────────┘

Commands by Language

Node.js (npm/yarn/pnpm)

bash

# Check prerequisitesscripts/check-tool.sh taze "npm install -g taze"
# Scan for updatestaze
# Apply minor/patchtaze minor --write
# Apply specific majorstaze major --write --include pkg1,pkg2
# Monorepo supporttaze -r  # recursive
# Securitynpm auditnpm audit fix

# Check prerequisitesscripts/check-tool.sh taze "npm install -g taze"
# Scan for updatestaze
# Apply minor/patchtaze minor --write
# Apply specific majorstaze major --write --include pkg1,pkg2
# Monorepo supporttaze -r  # recursive
# Securitynpm auditnpm audit fix

Python

bash

# Check outdatedpip list --outdated
# Update all (careful!)pip-review --auto
# Update specificpip install --upgrade package-name
# Securitypip-auditsafety check

# Check outdatedpip list --outdated
# Update all (careful!)pip-review --auto
# Update specificpip install --upgrade package-name
# Securitypip-auditsafety check

Go

bash

# Check outdatedgo list -m -u all
# Update allgo get -u ./...
# Tidy upgo mod tidy
# Securitygovulncheck ./...

# Check outdatedgo list -m -u all
# Update allgo get -u ./...
# Tidy upgo mod tidy
# Securitygovulncheck ./...

Rust

Ruby

bash

# Check outdatedbundle outdated
# Update allbundle update
# Update specificbundle update --conservative gem-name
# Securitybundle audit

# Check outdatedbundle outdated
# Update allbundle update
# Update specificbundle update --conservative gem-name
# Securitybundle audit

Java (Maven)

bash

# Check outdatedmvn versions:display-dependency-updates
# Update to latestmvn versions:use-latest-releases
# Securitymvn dependency:treemvn dependency-check:check

# Check outdatedmvn versions:display-dependency-updates
# Update to latestmvn versions:use-latest-releases
# Securitymvn dependency:treemvn dependency-check:check

.NET

bash

# Check outdateddotnet list package --outdated
# Update specificdotnet add package PackageName
# Securitydotnet list package --vulnerable

# Check outdateddotnet list package --outdated
# Update specificdotnet add package PackageName
# Securitydotnet list package --vulnerable

Diagnosis Mode

When dependencies are broken, run diagnosis:

Common Issues & Fixes

Issue	Symptoms	Fix
Version Conflict	"Cannot resolve dependency tree"	Clean install, use overrides/resolutions
Peer Dependency	"Peer dependency not satisfied"	Install required peer version
Security Vuln	`npm audit` shows issues	`npm audit fix` or manual update
Unused Deps	Bloated bundle	Run `depcheck` (Node) or equivalent
Duplicate Deps	Multiple versions installed	Run `npm dedupe` or equivalent

Emergency Fixes

bash

# Node.js - Nuclear resetrm -rf node_modules package-lock.jsonnpm cache clean --forcenpm install
# Python - Clean virtualenvrm -rf venvpython -m venv venvsource venv/bin/activatepip install -r requirements.txt
# Go - Reset modulesrm go.sumgo mod tidy

# Node.js - Nuclear resetrm -rf node_modules package-lock.jsonnpm cache clean --forcenpm install
# Python - Clean virtualenvrm -rf venvpython -m venv venvsource venv/bin/activatepip install -r requirements.txt
# Go - Reset modulesrm go.sumgo mod tidy

Security Audit

Run security checks for any project:

bash

# Node.jsnpm auditnpm audit --json | jq '.metadata.vulnerabilities'
# Pythonpip-auditsafety check
# Gogovulncheck ./...
# Rustcargo audit
# Rubybundle audit
# .NETdotnet list package --vulnerable

# Node.jsnpm auditnpm audit --json | jq '.metadata.vulnerabilities'
# Pythonpip-auditsafety check
# Gogovulncheck ./...
# Rustcargo audit
# Rubybundle audit
# .NETdotnet list package --vulnerable

Severity Response

Anti-Patterns

Avoid	Why	Instead
Update fixed versions	Intentionally pinned	Skip them
Auto-apply MAJOR	Breaking changes	Prompt user
Batch MAJOR prompts	Loses context	Prompt individually
Skip lock file	Irreproducible builds	Always commit lock files
Ignore security alerts	Vulnerabilities	Address by severity

Verification Checklist

After updates:

<details> <summary>Deep Dive: Project Detection</summary>

The skill auto-detects project type by scanning for package files:

File Found	Language	Package Manager
`package.json`	Node.js	npm/yarn/pnpm
`requirements.txt`	Python	pip
`pyproject.toml`	Python	pip/poetry
`Pipfile`	Python	pipenv
`go.mod`	Go	go modules
`Cargo.toml`	Rust	cargo
`Gemfile`	Ruby	bundler
`pom.xml`	Java	Maven
`build.gradle`	Java/Kotlin	Gradle
`*.csproj`	.NET	dotnet

Detection order matters for monorepos:

Check current directory first
Then check for workspace/monorepo patterns
Offer to run recursively if applicable

</details> <details> <summary>Deep Dive: Node.js with taze</summary>

Prerequisites

Smart Update Flow

bash

# 1. Scan all updatestaze
# 2. Apply safe updates (minor + patch)taze minor --write
# 3. For each major, prompt user:#    "Update @types/node from ^20.0.0 to ^22.0.0?"#    If yes, add to approved list
# 4. Apply approved majorstaze major --write --include approved-pkg1,approved-pkg2
# 5. Installnpm install  # or pnpm install / yarn

# 1. Scan all updatestaze
# 2. Apply safe updates (minor + patch)taze minor --write
# 3. For each major, prompt user:#    "Update @types/node from ^20.0.0 to ^22.0.0?"#    If yes, add to approved list
# 4. Apply approved majorstaze major --write --include approved-pkg1,approved-pkg2
# 5. Installnpm install  # or pnpm install / yarn

Auto-Approve List

Some packages have frequent major bumps but are backward-compatible:

</details> <details> <summary>Deep Dive: Version Strategies</summary>

Semantic Versioning

MAJOR.MINOR.PATCH (e.g., 2.3.1)
MAJOR: Breaking changes - requires code changesMINOR: New features - backward compatiblePATCH: Bug fixes - backward compatible

MAJOR.MINOR.PATCH (e.g., 2.3.1)
MAJOR: Breaking changes - requires code changesMINOR: New features - backward compatiblePATCH: Bug fixes - backward compatible

Range Specifiers

Recommended Strategy

json

{  "dependencies": {    "critical-lib": "1.2.3",      // Exact for critical    "stable-lib": "~1.2.3",       // Patch only for stable    "modern-lib": "^1.2.3"        // Minor OK for active  }}

{  "dependencies": {    "critical-lib": "1.2.3",      // Exact for critical    "stable-lib": "~1.2.3",       // Patch only for stable    "modern-lib": "^1.2.3"        // Minor OK for active  }}

</details> <details> <summary>Deep Dive: Conflict Resolution</summary>

Node.js Conflicts

Diagnosis:

bash

npm ls package-name      # See dependency treenpm explain package-name # Why installedyarn why package-name    # Yarn equivalent

npm ls package-name      # See dependency treenpm explain package-name # Why installedyarn why package-name    # Yarn equivalent

Resolution with overrides:

Resolution with resolutions (Yarn):

Python Conflicts

Diagnosis:

Resolution:

bash

# Use virtual environmentpython -m venv venvsource venv/bin/activatepip install -r requirements.txt
# Or use constraintspip install -c constraints.txt -r requirements.txt

# Use virtual environmentpython -m venv venvsource venv/bin/activatepip install -r requirements.txt
# Or use constraintspip install -c constraints.txt -r requirements.txt

</details>

Script Reference

Related Tools

Tool	Language	Purpose
taze	Node.js	Smart dependency updates
npm-check-updates	Node.js	Alternative to taze
pip-review	Python	Interactive pip updates
cargo-edit	Rust	Cargo dependency management
bundler-audit	Ruby	Security auditing

來源與署名

來源：softaworks/agent-toolkit位於skills/dependency-updater提交3027f20

授權條款： MIT

內容歸原作者所有。SourceWeft 從公開儲存庫中收錄這些內容。

檢舉或申請下架

Update Type	Version Change	Action
Fixed	No `^` or `~`	Skip (intentionally pinned)
PATCH	`x.y.z` → `x.y.Z`	Auto-apply
MINOR	`x.y.z` → `x.Y.0`	Auto-apply
MAJOR	`x.y.z` → `X.0.0`	Prompt user individually

Severity	Action
Critical	Fix immediately
High	Fix within 24h
Moderate	Fix within 1 week
Low	Fix in next release

Package	Reason
`lucide-react`	Icon library, majors are additive
`@types/*`	Type definitions, usually safe

Specifier	Meaning	Example
`^1.2.3`	Minor + Patch OK	`>=1.2.3 <2.0.0`
`~1.2.3`	Patch only	`>=1.2.3 <1.3.0`
`1.2.3`	Exact (fixed)	Only `1.2.3`
`>=1.2.3`	At least	Any `>=1.2.3`
`*`	Any	Latest (dangerous)

Script	Purpose
`scripts/check-tool.sh`	Verify tool is installed
`scripts/run-taze.sh`	Run taze with proper flags

Dependency Updater

Dependency Updater

Quick Start

Triggers

Supported Languages

Quick Reference

Workflow

Commands by Language

Node.js (npm/yarn/pnpm)

Python

Go

Rust

Ruby

Java (Maven)

.NET

Diagnosis Mode

Common Issues & Fixes

Emergency Fixes

Security Audit

Severity Response

Anti-Patterns

Verification Checklist

Prerequisites

Smart Update Flow

Auto-Approve List

Semantic Versioning

Range Specifiers

Recommended Strategy

Node.js Conflicts

Python Conflicts

Script Reference

Related Tools

來源與署名

更多來自 softaworks/agent-toolkit 的技能

Requirements Clarity

React Useeffect

Mui

Jira

Humanizer

Frontend To Backend Requirements

更多DevOps & Cloud技能

Playwright Devops

M5 Onboard

Yeet

Runbook

Incident Response

Deploy Checklist