dependency-updater

What this skill does

# Dependency Updater

## Overview

This skill analyzes your project's dependency tree to find outdated packages, known vulnerabilities, and breaking API changes. It produces a prioritized upgrade plan with specific migration steps, ordered to minimize risk and maximize safety.

## Instructions

### 1. Parse the Dependency File

- Read `package.json` + lockfile (npm/yarn/pnpm), `requirements.txt`/`pyproject.toml`, or `go.mod`
- List all direct dependencies with current pinned versions
- Note version constraints (^, ~, exact, ranges)

### 2. Check Each Package

For each dependency:
- **Latest version**: What's available on the registry
- **Version gap**: How many major/minor/patch versions behind
- **Security**: Known CVEs from npm audit, Snyk, or GitHub Advisory Database
- **Maintenance**: Last publish date, open issues count, whether it's deprecated
- **Breaking changes**: Read CHANGELOG.md or GitHub releases for breaking change notes between current and latest

### 3. Classify by Risk

Group packages into four tiers:
- **Critical**: Known CVE with severity HIGH or CRITICAL — update immediately
- **Major**: Major version bump with confirmed breaking API changes — needs migration
- **Minor**: Minor/patch updates with no breaking changes — safe to batch update
- **Stale**: Package unmaintained (no release in >12 months) — consider replacement

### 4. Scan for Impact

For Major-tier packages:
- Read the changelog/migration guide for the new version
- Search the codebase for imports and usages of changed APIs
- List affected files with line numbers
- Estimate effort: how many patterns need changing and whether they're automatable

### 5. Generate Upgrade Plan

Produce an ordered plan:
1. Critical (CVE fixes) first — usually patch-level, zero code changes
2. Minor/patch batch — single `npm update` command
3. Each Major upgrade individually, with:
   - Exact install command (`npm install package@version`)
   - Code changes needed (as diffs when possible)
   - Test commands to verify

## Examples

### Example 1: Node.js Project Audit

**Input**: User provides package.json with 94 dependencies.

**Output**:
```
Dependency Audit — 94 packages

CRITICAL (2 packages):
  lodash 4.17.20 → 4.17.21
    CVE-2021-23337 (Command Injection, HIGH)
    Fix: npm install [email protected] (patch, no code changes)

  node-fetch 2.6.1 → 2.6.13
    CVE-2022-0235 (Information Exposure, MEDIUM)
    Fix: npm install [email protected] (patch, no code changes)

MAJOR (1 package):
  express 4.18.2 → 5.0.0
    Breaking: req.host now returns host without port
    Breaking: app.del() removed, use app.delete()
    Affected files: src/server.ts:45 (uses req.host), src/routes/legacy.ts:12 (uses app.del)
    Migration effort: Low — 2 files, 2 line changes

MINOR (18 packages):
  Can be batch-updated: npm update (no breaking changes detected)

STALE (1 package):
  request 2.88.2 — DEPRECATED, last release Feb 2020
  Recommended replacement: undici or node-fetch
  Used in: src/lib/http-client.ts (3 call sites)

Upgrade Order:
  Step 1: npm install [email protected] [email protected]
  Step 2: npm update
  Step 3: npm install [email protected] (apply 2 code changes first)
  Step 4: Replace request with undici (separate PR recommended)
```

### Example 2: Python Requirements

**Input**: User provides requirements.txt with pinned versions.

**Output**:
```
Dependency Audit — 23 packages

CRITICAL:
  django==3.2.18 → 3.2.25
    CVE-2024-24680 (DoS via intcomma, MEDIUM)
    Fix: pip install django==3.2.25 (patch within same minor)

MAJOR:
  django==3.2.25 → 5.0.6 (if full upgrade desired)
    Breaking: DEFAULT_AUTO_FIELD must be set explicitly
    Breaking: url() removed, use path()
    Affected: 8 files in urls/, settings.py
```

## Guidelines

- Never recommend upgrading all major versions at once — one at a time, with tests between each
- For monorepos, check if packages have peer dependency conflicts before recommending upgrades
- If a package is deprecated with no CVE, it's STALE not CRITICAL — don't panic the user
- Always check if the project has a test suite (`npm test`, `pytest`) and recommend running it after each step
- When generating diffs, use the project's actual code, not generic examples
- For workspaces/monorepos, note which workspace each dependency belongs to