Dependency Updater

name: dependency-updater description: Smart dependency management for any language. Use when updating dependencies, checking for outdated packages, auditing security vulnerabilities, or diagnosing dependency conflicts. Auto-detects project type (Node.js, Python, Go, Rust, Ruby, Java, .NET), applies MINOR/PATCH updates automatically, and prompts for MAJOR version changes individually. tags: [dependencies, security, maintenance, updates]

Dependency Updater

Smart dependency management for any language with automatic detection and safe updates.

When to Use

• "Update dependencies", "update deps"
• "Check for outdated packages"
• "Fix my dependency problems"
• "Audit dependencies for vulnerabilities"
• Regular maintenance cycles

Supported Languages

Update Safety Rules

Workflow

Step 1: DETECT PROJECT TYPE
  Scan for package files (package.json, go.mod, etc.)
  Identify package manager
    |
Step 2: CHECK PREREQUISITES
  Verify required tools are installed
  Suggest installation if missing
    |
Step 3: SCAN FOR UPDATES
  Run language-specific outdated check
  Categorize: MAJOR / MINOR / PATCH / Fixed
    |
Step 4: AUTO-APPLY SAFE UPDATES
  Apply MINOR and PATCH automatically
  Report what was updated
    |
Step 5: PROMPT FOR MAJOR UPDATES
  Ask user for each MAJOR update individually
  Show current -> new version with changelog link
    |
Step 6: APPLY APPROVED MAJORS
  Update only approved packages
    |
Step 7: FINALIZE
  Run install command
  Run security audit
  Verify build still works

Commands by Language

Node.js

# Scan for updates
npx taze

# Apply minor/patch
npx taze minor --write

# Apply specific majors (after user approval)
npx taze major --write --include pkg1,pkg2

# Monorepo support
npx taze -r

# Security audit
npm audit
npm audit fix

Python

# Check outdated
pip list --outdated

# Update specific
pip install --upgrade package-name

# Security
pip-audit
safety check

Go

# Check outdated
go list -m -u all

# Update all
go get -u ./...
go mod tidy

# Security
govulncheck ./...

Rust

# Update within semver
cargo update

# Check outdated
cargo outdated

# Security
cargo audit

Java (Maven)

# Check outdated
mvn versions:display-dependency-updates

# Update to latest releases
mvn versions:use-latest-releases

# Security
mvn dependency-check:check

.NET

# Check outdated
dotnet list package --outdated

# Security
dotnet list package --vulnerable

Project Detection

Monorepo detection: Check current directory first, then workspace patterns, offer recursive scan if applicable.

Diagnosis Mode

Common Issues

Emergency Fixes

# Node.js - Clean reset
rm -rf node_modules package-lock.json
npm cache clean --force
npm install

# Python - Clean virtualenv
rm -rf .venv
python -m venv .venv
source .venv/bin/activate
pip install -r requirements.txt

# Go - Reset modules
rm go.sum
go mod tidy

Security Severity Response

Semver Quick Reference

MAJOR.MINOR.PATCH (e.g., 2.3.1)

^1.2.3  ->  >=1.2.3 <2.0.0  (minor + patch OK)
~1.2.3  ->  >=1.2.3 <1.3.0  (patch only)
1.2.3   ->  exactly 1.2.3    (pinned)

Anti-Patterns

Verification Checklist

• Updates scanned without errors
• MINOR/PATCH auto-applied
• MAJOR updates prompted individually
• Fixed versions untouched
• Lock file updated and committed
• Install command succeeded
• Security audit passed (or issues noted)
• Test suite still passes

References

• Based on softaworks/agent-toolkit dependency-updater (MIT License)
• taze -- Smart Node.js dependency updates
• pip-audit -- Python vulnerability scanning
• govulncheck -- Go vulnerability checking