Dependency Updater

<!-- AUTO-GENERATED by export-skills.py — DO NOT EDIT -->
---
name: dependency-updater
description: Smart dependency management for any language. Use when updating dependencies, checking for outdated packages, auditing security vulnerabilities, or diagnosing dependency conflicts. Auto-detects project type (Node.js, Python, Go, Rust, Ruby, Java, .NET), applies MINOR/PATCH updates automatically, and prompts for MAJOR version changes individually.
---

# Dependency Updater

Smart dependency management for any language with automatic detection and safe updates.

## When to Use

- "Update dependencies", "update deps"
- "Check for outdated packages"
- "Fix my dependency problems"
- "Audit dependencies for vulnerabilities"
- Regular maintenance cycles

## Supported Languages

| Language | Package File | Update Tool | Audit Tool |
|---|---|---|---|
| **Node.js** | package.json | `taze` | `npm audit` |
| **Python** | requirements.txt, pyproject.toml | `pip-review` | `pip-audit`, `safety` |
| **Go** | go.mod | `go get -u` | `govulncheck` |
| **Rust** | Cargo.toml | `cargo update` | `cargo audit` |
| **Ruby** | Gemfile | `bundle update` | `bundle audit` |
| **Java** | pom.xml, build.gradle | `mvn versions:*` | `mvn dependency-check:check` |
| **.NET** | *.csproj | `dotnet outdated` | `dotnet list package --vulnerable` |

## Update Safety Rules

| Update Type | Version Change | Action |
|---|---|---|
| **Fixed** | No `^` or `~` | Skip (intentionally pinned) |
| **PATCH** | `x.y.z` -> `x.y.Z` | Auto-apply |
| **MINOR** | `x.y.z` -> `x.Y.0` | Auto-apply |
| **MAJOR** | `x.y.z` -> `X.0.0` | Prompt user individually |

## Workflow

```
Step 1: DETECT PROJECT TYPE
  Scan for package files (package.json, go.mod, etc.)
  Identify package manager
    |
Step 2: CHECK PREREQUISITES
  Verify required tools are installed
  Suggest installation if missing
    |
Step 3: SCAN FOR UPDATES
  Run language-specific outdated check
  Categorize: MAJOR / MINOR / PATCH / Fixed
    |
Step 4: AUTO-APPLY SAFE UPDATES
  Apply MINOR and PATCH automatically
  Report what was updated
    |
Step 5: PROMPT FOR MAJOR UPDATES
  Ask user for each MAJOR update individually
  Show current -> new version with changelog link
    |
Step 6: APPLY APPROVED MAJORS
  Update only approved packages
    |
Step 7: FINALIZE
  Run install command
  Run security audit
  Verify build still works
```

## Commands by Language

### Node.js

```bash
# Scan for updates
npx taze

# Apply minor/patch
npx taze minor --write

# Apply specific majors (after user approval)
npx taze major --write --include pkg1,pkg2

# Monorepo support
npx taze -r

# Security audit
npm audit
npm audit fix
```

### Python

```bash
# Check outdated
pip list --outdated

# Update specific
pip install --upgrade package-name

# Security
pip-audit
safety check
```

### Go

```bash
# Check outdated
go list -m -u all

# Update all
go get -u ./...
go mod tidy

# Security
govulncheck ./...
```

### Rust

```bash
# Update within semver
cargo update

# Check outdated
cargo outdated

# Security
cargo audit
```

### Java (Maven)

```bash
# Check outdated
mvn versions:display-dependency-updates

# Update to latest releases
mvn versions:use-latest-releases

# Security
mvn dependency-check:check
```

### .NET

```bash
# Check outdated
dotnet list package --outdated

# Security
dotnet list package --vulnerable
```

## Project Detection

| File Found | Language | Package Manager |
|---|---|---|
| `package.json` | Node.js | npm/yarn/pnpm (check lockfile) |
| `requirements.txt` | Python | pip |
| `pyproject.toml` | Python | pip/poetry/uv |
| `Pipfile` | Python | pipenv |
| `go.mod` | Go | go modules |
| `Cargo.toml` | Rust | cargo |
| `Gemfile` | Ruby | bundler |
| `pom.xml` | Java | Maven |
| `build.gradle` | Java/Kotlin | Gradle |
| `*.csproj` | .NET | dotnet |

**Monorepo detection**: Check current directory first, then workspace patterns, offer recursive scan if applicable.

## Diagnosis Mode

### Common Issues

| Issue | Symptoms | Fix |
|---|---|---|
| **Version Conflict** | "Cannot resolve dependency tree" | Clean install, use overrides/resolutions |
| **Peer Dependency** | "Peer dependency not satisfied" | Install required peer version |
| **Security Vuln** | audit shows issues | `npm audit fix` or manual update |
| **Unused Deps** | Bloated bundle | Run `depcheck` (Node) or equivalent |
| **Duplicate Deps** | Multiple versions installed | Run `npm dedupe` or equivalent |

### Emergency Fixes

```bash
# Node.js - Clean reset
rm -rf node_modules package-lock.json
npm cache clean --force
npm install

# Python - Clean virtualenv
rm -rf .venv
python -m venv .venv
source .venv/bin/activate
pip install -r requirements.txt

# Go - Reset modules
rm go.sum
go mod tidy
```

## Security Severity Response

| Severity | Action |
|---|---|
| **Critical** | Fix immediately |
| **High** | Fix within 24h |
| **Moderate** | Fix within 1 week |
| **Low** | Fix in next release |

## Semver Quick Reference

```
MAJOR.MINOR.PATCH (e.g., 2.3.1)

^1.2.3  ->  >=1.2.3 <2.0.0  (minor + patch OK)
~1.2.3  ->  >=1.2.3 <1.3.0  (patch only)
1.2.3   ->  exactly 1.2.3    (pinned)
```

## Anti-Patterns

| Avoid | Why | Instead |
|---|---|---|
| Update pinned versions | Intentionally pinned for a reason | Skip them, ask if unsure |
| Auto-apply MAJOR | Breaking changes risk | Prompt user individually |
| Batch MAJOR prompts | User loses context on each | One at a time |
| Skip lock file commit | Irreproducible builds | Always commit lock files |
| Ignore security alerts | Vulnerabilities compound | Address by severity |
| Update without tests | Silent breakage | Run test suite after updates |

## Verification Checklist

- [ ] Updates scanned without errors
- [ ] MINOR/PATCH auto-applied
- [ ] MAJOR updates prompted individually
- [ ] Fixed versions untouched
- [ ] Lock file updated and committed
- [ ] Install command succeeded
- [ ] Security audit passed (or issues noted)
- [ ] Test suite still passes

## References

- Based on [softaworks/agent-toolkit dependency-updater](https://github.com/softaworks/agent-toolkit/tree/main/skills/dependency-updater) (MIT License)
- [taze](https://github.com/antfu-collective/taze) -- Smart Node.js dependency updates
- [pip-audit](https://github.com/pypa/pip-audit) -- Python vulnerability scanning
- [govulncheck](https://pkg.go.dev/golang.org/x/vuln/cmd/govulncheck) -- Go vulnerability checking

<!-- Source: .faos/custom/skills/devops/dependency-updater/SKILL.md -->