Review Dependencies
Detect package managers and CI action pins, then discover outdated or vulnerable dependencies. Analysis only. Does not upgrade.
Step 1: Detect Package Managers
Identify which package managers are in use by searching for config files:
| Config file |
Package manager |
Lockfile |
Ecosystem |
package.json |
npm / yarn / pnpm |
package-lock.json / yarn.lock / pnpm-lock.yaml |
Node.js |
Package.swift, *.xcodeproj |
Swift Package Manager |
Package.resolved |
Swift |
pyproject.toml, requirements.txt, setup.py |
pip / poetry / uv |
poetry.lock, uv.lock |
Python |
Cargo.toml |
cargo |
Cargo.lock |
Rust |
go.mod |
Go modules |
go.sum |
Go |
Gemfile |
Bundler |
Gemfile.lock |
Ruby |
pom.xml |
Maven |
— |
Java |
build.gradle, build.gradle.kts |
Gradle |
gradle.lockfile |
Java/Kotlin |
.github/workflows/*.yml / .yaml, action.yml / .yaml |
GitHub Actions |
— |
CI |
Swift dependencies can live in Package.swift or be configured directly in the Xcode project file (.xcodeproj/.xcworkspace). For Xcode-managed dependencies, inspect the project's package references.
Detection steps:
- Search for config files in the project root and subdirectories (exclude vendored directories)
- If a lockfile exists, use the corresponding package manager variant (e.g.,
yarn.lock → yarn, pnpm-lock.yaml → pnpm)
- When the repo declares a dependency automation config (
.github/dependabot.yml / .yaml, renovate.json, .github/renovate.json), read it and add every ecosystem it declares to the set found by the config-file search
- When the repo has a GitHub remote, list open dependency PRs with
gh pr list --author app/dependabot (or app/renovate), and mark each upgrade one of them already proposes
- If multiple instances of the same package manager found (e.g., monorepo with several
package.json files): use AskUserQuestion to let the user choose which to review (multiSelect allowed)
- If multiple package managers found: use
AskUserQuestion to let the user choose which to review. Exclude the CI ecosystem from that choice and review it alongside whichever the user picks
- If none found across every step above: inform user and stop
Step 2: Discovery
Run the appropriate discovery command to find available updates:
| Package manager |
Discovery command |
Notes |
| npm |
ncu --format group |
Requires npm-check-updates. Suggest npm install -g npm-check-updates if missing. |
| yarn |
ncu --format group or yarn upgrade-interactive |
|
| pnpm |
ncu --format group or pnpm outdated |
|
| Swift PM |
Check resolved versions in Package.resolved against latest releases via WebSearch |
No built-in outdated command. Read Package.swift or inspect the Xcode project to identify dependencies and their current version constraints. |
| pip |
pip list --outdated |
|
| poetry |
poetry show --outdated |
|
| uv |
uv pip list --outdated |
|
| cargo |
cargo outdated |
Requires cargo-outdated. Fall back to comparing Cargo.toml versions via WebSearch. |
| Go modules |
go list -m -u all |
|
| Bundler |
bundle outdated |
|
| Maven |
mvn versions:display-dependency-updates |
|
| Gradle |
gradle dependencyUpdates |
Requires com.github.ben-manes.versions plugin. |
| GitHub Actions |
gh api repos/<owner>/<repo>/releases/latest --jq .tag_name, compared against each uses: ref |
No outdated command. Take <owner>/<repo> from the ref's first two path segments. Read a SHA-pinned ref's version from its trailing comment (uses: <owner>/<action>@<sha> # v1.2.3). Compare only the components the ref pins, so @v7 is current against v7.0.1. Fall back to repos/<owner>/<repo>/tags when the release 404s or its tag namespace differs from the ref's, and to WebSearch when the action is not hosted on GitHub. Exclude local (./…), <repo-relative> ($/…), and Docker (docker://…) refs, which pin no release. |
Categorize updates:
- Major (breaking changes) — requires migration research
- Minor (new features, backward compatible)
- Patch (bug fixes)
Step 3: Report Findings
If the discovery tool is not installed, suggest the installation command (see Step 2 notes column). If no tool exists for the ecosystem, fall back to manual version checking via WebSearch.
If no updates are available, report that dependencies are up to date.
Output Format
Format each finding as:
### [P<N>] <title (imperative, <=80 chars)>
**Package:** `<name>` <current> -> <latest>
**Manager:** <npm/pip/cargo/etc.>
**Proposed:** <open automation PR already covering this upgrade, when one exists>
<one paragraph: why this matters, known vulnerabilities if any, major version gap>
After all findings, add:
## Overall Verdict
**Dependencies:** <up to date | updates available>
<summary with counts: N major, N minor, N patch>
Priority Levels
- P0 — Known security vulnerability (CVE) in the current version
- P1 — Multiple major versions behind (e.g., React 17 → 19)
- P2 — One major version behind or significantly outdated minor versions
- P3 — Minor or patch updates available
1---2name: review-dependencies3description: Detect package managers and CI action pins, then discover outdated or vulnerable dependencies. Returns structured findings without upgrading. Use when the user asks to "review dependencies", "check for outdated packages", "check dependencies", "scan dependencies", "dependency review", "check for outdated GitHub Actions", or "are my workflow actions up to date".4---56# Review Dependencies78Detect package managers and CI action pins, then discover outdated or vulnerable dependencies. Analysis only. Does not upgrade.910## Step 1: Detect Package Managers1112Identify which package managers are in use by searching for config files:1314| Config file | Package manager | Lockfile | Ecosystem |15|---|---|---|---|16| `package.json` | npm / yarn / pnpm | `package-lock.json` / `yarn.lock` / `pnpm-lock.yaml` | Node.js |17| `Package.swift`, `*.xcodeproj` | Swift Package Manager | `Package.resolved` | Swift |18| `pyproject.toml`, `requirements.txt`, `setup.py` | pip / poetry / uv | `poetry.lock`, `uv.lock` | Python |19| `Cargo.toml` | cargo | `Cargo.lock` | Rust |20| `go.mod` | Go modules | `go.sum` | Go |21| `Gemfile` | Bundler | `Gemfile.lock` | Ruby |22| `pom.xml` | Maven | — | Java |23| `build.gradle`, `build.gradle.kts` | Gradle | `gradle.lockfile` | Java/Kotlin |24| `.github/workflows/*.yml` / `.yaml`, `action.yml` / `.yaml` | GitHub Actions | — | CI |2526Swift dependencies can live in `Package.swift` or be configured directly in the Xcode project file (`.xcodeproj`/`.xcworkspace`). For Xcode-managed dependencies, inspect the project's package references.2728Detection steps:29301. Search for config files in the project root and subdirectories (exclude vendored directories)312. If a lockfile exists, use the corresponding package manager variant (e.g., `yarn.lock` → yarn, `pnpm-lock.yaml` → pnpm)323. When the repo declares a dependency automation config (`.github/dependabot.yml` / `.yaml`, `renovate.json`, `.github/renovate.json`), read it and add every ecosystem it declares to the set found by the config-file search334. When the repo has a GitHub remote, list open dependency PRs with `gh pr list --author app/dependabot` (or `app/renovate`), and mark each upgrade one of them already proposes345. If **multiple instances of the same package manager** found (e.g., monorepo with several `package.json` files): use `AskUserQuestion` to let the user choose which to review (multiSelect allowed)356. If **multiple package managers** found: use `AskUserQuestion` to let the user choose which to review. Exclude the CI ecosystem from that choice and review it alongside whichever the user picks367. If **none** found across every step above: inform user and stop3738## Step 2: Discovery3940Run the appropriate discovery command to find available updates:4142| Package manager | Discovery command | Notes |43|---|---|---|44| npm | `ncu --format group` | Requires `npm-check-updates`. Suggest `npm install -g npm-check-updates` if missing. |45| yarn | `ncu --format group` or `yarn upgrade-interactive` | |46| pnpm | `ncu --format group` or `pnpm outdated` | |47| Swift PM | Check resolved versions in `Package.resolved` against latest releases via WebSearch | No built-in outdated command. Read `Package.swift` or inspect the Xcode project to identify dependencies and their current version constraints. |48| pip | `pip list --outdated` | |49| poetry | `poetry show --outdated` | |50| uv | `uv pip list --outdated` | |51| cargo | `cargo outdated` | Requires `cargo-outdated`. Fall back to comparing `Cargo.toml` versions via WebSearch. |52| Go modules | `go list -m -u all` | |53| Bundler | `bundle outdated` | |54| Maven | `mvn versions:display-dependency-updates` | |55| Gradle | `gradle dependencyUpdates` | Requires `com.github.ben-manes.versions` plugin. |56| GitHub Actions | `gh api repos/<owner>/<repo>/releases/latest --jq .tag_name`, compared against each `uses:` ref | No outdated command. Take `<owner>/<repo>` from the ref's first two path segments. Read a SHA-pinned ref's version from its trailing comment (`uses: <owner>/<action>@<sha> # v1.2.3`). Compare only the components the ref pins, so `@v7` is current against `v7.0.1`. Fall back to `repos/<owner>/<repo>/tags` when the release 404s or its tag namespace differs from the ref's, and to WebSearch when the action is not hosted on GitHub. Exclude local (`./…`), `<repo-relative>` (`$/…`), and Docker (`docker://…`) refs, which pin no release. |5758Categorize updates:59- **Major** (breaking changes) — requires migration research60- **Minor** (new features, backward compatible)61- **Patch** (bug fixes)6263## Step 3: Report Findings6465If the discovery tool is not installed, suggest the installation command (see Step 2 notes column). If no tool exists for the ecosystem, fall back to manual version checking via WebSearch.6667If no updates are available, report that dependencies are up to date.6869## Output Format7071Format each finding as:7273```74### [P<N>] <title (imperative, <=80 chars)>7576**Package:** `<name>` <current> -> <latest>77**Manager:** <npm/pip/cargo/etc.>78**Proposed:** <open automation PR already covering this upgrade, when one exists>7980<one paragraph: why this matters, known vulnerabilities if any, major version gap>81```8283After all findings, add:8485```86## Overall Verdict8788**Dependencies:** <up to date | updates available>8990<summary with counts: N major, N minor, N patch>91```9293## Priority Levels9495- **P0** — Known security vulnerability (CVE) in the current version96- **P1** — Multiple major versions behind (e.g., React 17 → 19)97- **P2** — One major version behind or significantly outdated minor versions98- **P3** — Minor or patch updates available
gabrielmoreira