frank-luongt/skills/codex/dependency-updater

<!-- AUTO-GENERATED by export-skills.py — DO NOT EDIT -->

---

name: dependency-updater description: Smart dependency management for any language. Use when updating dependencies, checking for outdated packages, auditing security vulnerabilities, or diagnosing dependency conflicts. Auto-detects project type (Node.js, Python, Go, Rust, Ruby, Java, .NET), applies MINOR/PATCH updates automatically, and prompts for MAJOR version changes individually.

Dependency Updater

Smart dependency management for any language with automatic detection and safe updates.

When to Use

• "Update dependencies", "update deps"
• "Check for outdated packages"
• "Fix my dependency problems"
• "Audit dependencies for vulnerabilities"
• Regular maintenance cycles

Supported Languages

| Language | Package File | Update Tool | Audit Tool | |---|---|---|---| | Node.js | package.json | taze | npm audit | | Python | requirements.txt, pyproject.toml | pip-review | pip-audit, safety | | Go | go.mod | go get -u | govulncheck | | Rust | Cargo.toml | cargo update | cargo audit | | Ruby | Gemfile | bundle update | bundle audit | | Java | pom.xml, build.gradle | mvn versions:* | mvn dependency-check:check | | .NET | *.csproj | dotnet outdated | dotnet list package --vulnerable |

Update Safety Rules

| Update Type | Version Change | Action | |---|---|---| | Fixed | No ^ or ~ | Skip (intentionally pinned) | | PATCH | x.y.z -> x.y.Z | Auto-apply | | MINOR | x.y.z -> x.Y.0 | Auto-apply | | MAJOR | x.y.z -> X.0.0 | Prompt user individually |

Workflow

Step 1: DETECT PROJECT TYPE
  Scan for package files (package.json, go.mod, etc.)
  Identify package manager
    |
Step 2: CHECK PREREQUISITES
  Verify required tools are installed
  Suggest installation if missing
    |
Step 3: SCAN FOR UPDATES
  Run language-specific outdated check
  Categorize: MAJOR / MINOR / PATCH / Fixed
    |
Step 4: AUTO-APPLY SAFE UPDATES
  Apply MINOR and PATCH automatically
  Report what was updated
    |
Step 5: PROMPT FOR MAJOR UPDATES
  Ask user for each MAJOR update individually
  Show current -> new version with changelog link
    |
Step 6: APPLY APPROVED MAJORS
  Update only approved packages
    |
Step 7: FINALIZE
  Run install command
  Run security audit
  Verify build still works

Commands by Language

Node.js

# Scan for updates
npx taze

# Apply minor/patch
npx taze minor --write

# Apply specific majors (after user approval)
npx taze major --write --include pkg1,pkg2

# Monorepo support
npx taze -r

# Security audit
npm audit
npm audit fix

Python

# Check outdated
pip list --outdated

# Update specific
pip install --upgrade package-name

# Security
pip-audit
safety check

Go

# Check outdated
go list -m -u all

# Update all
go get -u ./...
go mod tidy

# Security
govulncheck ./...

Rust

# Update within semver
cargo update

# Check outdated
cargo outdated

# Security
cargo audit

Java (Maven)

# Check outdated
mvn versions:display-dependency-updates

# Update to latest releases
mvn versions:use-latest-releases

# Security
mvn dependency-check:check

.NET

# Check outdated
dotnet list package --outdated

# Security
dotnet list package --vulnerable

Project Detection

| File Found | Language | Package Manager | |---|---|---| | package.json | Node.js | npm/yarn/pnpm (check lockfile) | | requirements.txt | Python | pip | | pyproject.toml | Python | pip/poetry/uv | | Pipfile | Python | pipenv | | go.mod | Go | go modules | | Cargo.toml | Rust | cargo | | Gemfile | Ruby | bundler | | pom.xml | Java | Maven | | build.gradle | Java/Kotlin | Gradle | | *.csproj | .NET | dotnet |

Monorepo detection: Check current directory first, then workspace patterns, offer recursive scan if applicable.

Diagnosis Mode

Common Issues

| Issue | Symptoms | Fix | |---|---|---| | Version Conflict | "Cannot resolve dependency tree" | Clean install, use overrides/resolutions | | Peer Dependency | "Peer dependency not satisfied" | Install required peer version | | Security Vuln | audit shows issues | npm audit fix or manual update | | Unused Deps | Bloated bundle | Run depcheck (Node) or equivalent | | Duplicate Deps | Multiple versions installed | Run npm dedupe or equivalent |

Emergency Fixes

# Node.js - Clean reset
rm -rf node_modules package-lock.json
npm cache clean --force
npm install

# Python - Clean virtualenv
rm -rf .venv
python -m venv .venv
source .venv/bin/activate
pip install -r requirements.txt

# Go - Reset modules
rm go.sum
go mod tidy

Security Severity Response

| Severity | Action | |---|---| | Critical | Fix immediately | | High | Fix within 24h | | Moderate | Fix within 1 week | | Low | Fix in next release |

Semver Quick Reference

MAJOR.MINOR.PATCH (e.g., 2.3.1)

^1.2.3  ->  >=1.2.3 <2.0.0  (minor + patch OK)
~1.2.3  ->  >=1.2.3 <1.3.0  (patch only)
1.2.3   ->  exactly 1.2.3    (pinned)

Anti-Patterns

| Avoid | Why | Instead | |---|---|---| | Update pinned versions | Intentionally pinned for a reason | Skip them, ask if unsure | | Auto-apply MAJOR | Breaking changes risk | Prompt user individually | | Batch MAJOR prompts | User loses context on each | One at a time | | Skip lock file commit | Irreproducible builds | Always commit lock files | | Ignore security alerts | Vulnerabilities compound | Address by severity | | Update without tests | Silent breakage | Run test suite after updates |

Verification Checklist

• [ ] Updates scanned without errors
• [ ] MINOR/PATCH auto-applied
• [ ] MAJOR updates prompted individually
• [ ] Fixed versions untouched
• [ ] Lock file updated and committed
• [ ] Install command succeeded
• [ ] Security audit passed (or issues noted)
• [ ] Test suite still passes

References

• Based on softaworks/agent-toolkit dependency-updater (MIT License)
• taze -- Smart Node.js dependency updates
• pip-audit -- Python vulnerability scanning
• govulncheck -- Go vulnerability checking

<!-- Source: .faos/custom/skills/devops/dependency-updater/SKILL.md -->