# Os Update Checker

> Check for available OS package updates with per-package changelog summaries and risk classification. Supports apt (Debian/Ubuntu), dnf (Fedora/RHEL), yum (CentOS 7), pacman (Arch), zypper (openSUSE), apk (Alpine), and brew (macOS). Use when: checking system update status, before approving upgrades, or in heartbeats/cron for periodic OS health monitoring. Read-only — does not install or modify anything.

- Skill: `dvcrn/os-update-checker` (Agent Skill, multi-file: 3 files)
- Install (CLI): `npx skillmds@latest add dvcrn/os-update-checker`
- Raw SKILL.md: https://api.skillmd.com/api/skills/dvcrn/os-update-checker/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: dvcrn (https://skillmd.com/u/dvcrn)
- Updated: 2026-09-08
- Page: https://skillmd.com/skills/dvcrn/os-update-checker

---


# OS Update Checker

Read-only, cross-platform package update checker. Auto-detects the available package manager, lists upgradable packages, fetches changelogs, and classifies risk (security, moderate, low). Designed to give enough context to approve or defer an upgrade confidently.

## Supported Package Managers

| OS | Package Manager |
|---|---|
| Debian / Ubuntu / Mint | `apt` |
| Fedora / RHEL 8+ / Rocky / Alma | `dnf` |
| CentOS 7 / RHEL 7 | `yum` |
| Arch / Manjaro / EndeavourOS | `pacman` / `checkupdates` |
| openSUSE Leap / Tumbleweed / SLES | `zypper` |
| Alpine Linux | `apk` |
| macOS / Linux (Homebrew) | `brew` |

## Usage

```bash
# Human-readable summary with changelogs (auto-detects OS)
python3 scripts/check_updates.py

# JSON output (for dashboards, cron, integrations)
python3 scripts/check_updates.py --format json

# Skip changelogs for a quick count
python3 scripts/check_updates.py --no-changelog
```

## Risk Classification

- 🔴 **security** — source repo contains a security indicator
- 🟡 **moderate** — critical package (kernel, openssh, openssl, sudo, curl, bash, etc.)
- 🟢 **low** — standard maintenance update

## How It Works

1. **Detects** available package manager from PATH (`apt` → `dnf` → `yum` → `pacman` → `zypper` → `apk` → `brew`)
2. **Lists** upgradable packages using the appropriate read-only command
3. **Validates** each package name against a per-backend allowlist regex before any further use
4. **Fetches** the most recent changelog entry per package (apt: `apt changelog`; dnf/yum: `rpm --changelog`; others: package info)
5. **Reports** in text or JSON format

## Security Design

- `subprocess` is used exclusively with `shell=False` — arguments are passed as a list, never interpolated into a shell string
- Package names are validated against per-backend allowlist patterns before use in commands
- All exceptions are caught by specific type — no bare `except`
- Read-only commands only — no installs, no writes, no service restarts

## System Access

- **Commands (read-only):** `apt list`, `apt changelog`, `dnf check-update`, `rpm -q --changelog`, `yum check-update`, `pacman -Qu`, `pacman -Si`, `zypper list-updates`, `zypper info`, `apk list`, `apk info`, `brew outdated`, `brew info`
- **Network:** Outbound HTTPS to distribution changelog servers (apt only; others use local package metadata)
- **No file writes**

## Requirements

- Python 3.10+
- One supported package manager available on PATH