#601

Globales Ranking · von 601 Skills

dependency-updater AI Agent Skill

Quellcode ansehen: cachemoney/agent-toolkit

Medium

Installation

npx skills add cachemoney/agent-toolkit --skill dependency-updater

6

Installationen

Dependency Updater

Smart dependency management for any language with automatic detection and safe updates.

Quick Start

update my dependencies

The skill auto-detects your project type and handles the rest.

Triggers

Trigger Example
Update dependencies "update dependencies", "update deps"
Check outdated "check for outdated packages"
Fix dependency issues "fix my dependency problems"
Security audit "audit dependencies for vulnerabilities"
Diagnose deps "diagnose dependency issues"

Supported Languages

Language Package File Update Tool Audit Tool
Node.js package.json taze npm audit
Python requirements.txt, pyproject.toml pip-review safety, pip-audit
Go go.mod go get -u govulncheck
Rust Cargo.toml cargo update cargo audit
Ruby Gemfile bundle update bundle audit
Java pom.xml, build.gradle mvn versions:* mvn dependency:*
.NET *.csproj dotnet outdated dotnet list package --vulnerable

Quick Reference

Update Type Version Change Action
Fixed No ^ or ~ Skip (intentionally pinned)
PATCH x.y.z → x.y.Z Auto-apply
MINOR x.y.z → x.Y.0 Auto-apply
MAJOR x.y.z → X.0.0 Prompt user individually

Workflow

User Request
    │
    ▼
┌─────────────────────────────────────────────────────┐
│ Step 1: DETECT PROJECT TYPE                         │
│ • Scan for package files (package.json, go.mod...) │
│ • Identify package manager                          │
├─────────────────────────────────────────────────────┤
│ Step 2: CHECK PREREQUISITES                         │
│ • Verify required tools are installed               │
│ • Suggest installation if missing                   │
├─────────────────────────────────────────────────────┤
│ Step 3: SCAN FOR UPDATES                            │
│ • Run language-specific outdated check              │
│ • Categorize: MAJOR / MINOR / PATCH / Fixed         │
├─────────────────────────────────────────────────────┤
│ Step 4: AUTO-APPLY SAFE UPDATES                     │
│ • Apply MINOR and PATCH automatically               │
│ • Report what was updated                           │
├─────────────────────────────────────────────────────┤
│ Step 5: PROMPT FOR MAJOR UPDATES                    │
│ • AskUserQuestion for each MAJOR update             │
│ • Show current → new version                        │
├─────────────────────────────────────────────────────┤
│ Step 6: APPLY APPROVED MAJORS                       │
│ • Update only approved packages                     │
├─────────────────────────────────────────────────────┤
│ Step 7: FINALIZE                                    │
│ • Run install command                               │
│ • Run security audit                                │
└─────────────────────────────────────────────────────┘

Commands by Language

Node.js (npm/yarn/pnpm)

# Check prerequisites
scripts/check-tool.sh taze "npm install -g taze"

# Scan for updates
taze

# Apply minor/patch
taze minor --write

# Apply specific majors
taze major --write --include pkg1,pkg2

# Monorepo support
taze -r  # recursive

# Security
npm audit
npm audit fix

Python

# Check outdated
pip list --outdated

# Update all (careful!)
pip-review --auto

# Update specific
pip install --upgrade package-name

# Security
pip-audit
safety check

Go

# Check outdated
go list -m -u all

# Update all
go get -u ./...

# Tidy up
go mod tidy

# Security
govulncheck ./...

Rust

# Check outdated
cargo outdated

# Update within semver
cargo update

# Security
cargo audit

Ruby

# Check outdated
bundle outdated

# Update all
bundle update

# Update specific
bundle update --conservative gem-name

# Security
bundle audit

Java (Maven)

# Check outdated
mvn versions:display-dependency-updates

# Update to latest
mvn versions:use-latest-releases

# Security
mvn dependency:tree
mvn dependency-check:check

.NET

# Check outdated
dotnet list package --outdated

# Update specific
dotnet add package PackageName

# Security
dotnet list package --vulnerable

Diagnosis Mode

When dependencies are broken, run diagnosis:

Common Issues & Fixes

Issue Symptoms Fix
Version Conflict "Cannot resolve dependency tree" Clean install, use overrides/resolutions
Peer Dependency "Peer dependency not satisfied" Install required peer version
Security Vuln npm audit shows issues npm audit fix or manual update
Unused Deps Bloated bundle Run depcheck (Node) or equivalent
Duplicate Deps Multiple versions installed Run npm dedupe or equivalent

Emergency Fixes

# Node.js - Nuclear reset
rm -rf node_modules package-lock.json
npm cache clean --force
npm install

# Python - Clean virtualenv
rm -rf venv
python -m venv venv
source venv/bin/activate
pip install -r requirements.txt

# Go - Reset modules
rm go.sum
go mod tidy

Security Audit

Run security checks for any project:

# Node.js
npm audit
npm audit --json | jq '.metadata.vulnerabilities'

# Python
pip-audit
safety check

# Go
govulncheck ./...

# Rust
cargo audit

# Ruby
bundle audit

# .NET
dotnet list package --vulnerable

Severity Response

Severity Action
Critical Fix immediately
High Fix within 24h
Moderate Fix within 1 week
Low Fix in next release

Anti-Patterns

Avoid Why Instead
Update fixed versions Intentionally pinned Skip them
Auto-apply MAJOR Breaking changes Prompt user
Batch MAJOR prompts Loses context Prompt individually
Skip lock file Irreproducible builds Always commit lock files
Ignore security alerts Vulnerabilities Address by severity

Verification Checklist

After updates:

  • Updates scanned without errors
  • MINOR/PATCH auto-applied
  • MAJOR updates prompted individually
  • Fixed versions untouched
  • Lock file updated
  • Install command ran
  • Security audit passed (or issues noted)
Deep Dive: Project Detection

The skill auto-detects project type by scanning for package files:

File Found Language Package Manager
package.json Node.js npm/yarn/pnpm
requirements.txt Python pip
pyproject.toml Python pip/poetry
Pipfile Python pipenv
go.mod Go go modules
Cargo.toml Rust cargo
Gemfile Ruby bundler
pom.xml Java Maven
build.gradle Java/Kotlin Gradle
*.csproj .NET dotnet

Detection order matters for monorepos:

  1. Check current directory first
  2. Then check for workspace/monorepo patterns
  3. Offer to run recursively if applicable
Deep Dive: Node.js with taze

Prerequisites

# Install taze globally (recommended)
npm install -g taze

# Or use npx
npx taze

Smart Update Flow

# 1. Scan all updates
taze

# 2. Apply safe updates (minor + patch)
taze minor --write

# 3. For each major, prompt user:
#    "Update @types/node from ^20.0.0 to ^22.0.0?"
#    If yes, add to approved list

# 4. Apply approved majors
taze major --write --include approved-pkg1,approved-pkg2

# 5. Install
npm install  # or pnpm install / yarn

Auto-Approve List

Some packages have frequent major bumps but are backward-compatible:

Package Reason
lucide-react Icon library, majors are additive
@types/* Type definitions, usually safe
Deep Dive: Version Strategies

Semantic Versioning

MAJOR.MINOR.PATCH (e.g., 2.3.1)

MAJOR: Breaking changes - requires code changes
MINOR: New features - backward compatible
PATCH: Bug fixes - backward compatible

Range Specifiers

Specifier Meaning Example
^1.2.3 Minor + Patch OK >=1.2.3 <2.0.0
~1.2.3 Patch only >=1.2.3 <1.3.0
1.2.3 Exact (fixed) Only 1.2.3
>=1.2.3 At least Any >=1.2.3
* Any Latest (dangerous)

Recommended Strategy

{
  "dependencies": {
    "critical-lib": "1.2.3",      // Exact for critical
    "stable-lib": "~1.2.3",       // Patch only for stable
    "modern-lib": "^1.2.3"        // Minor OK for active
  }
}
Deep Dive: Conflict Resolution

Node.js Conflicts

Diagnosis:

npm ls package-name      # See dependency tree
npm explain package-name # Why installed
yarn why package-name    # Yarn equivalent

Resolution with overrides:

// package.json
{
  "overrides": {
    "lodash": "^4.18.0"
  }
}

Resolution with resolutions (Yarn):

{
  "resolutions": {
    "lodash": "^4.18.0"
  }
}

Python Conflicts

Diagnosis:

pip check
pipdeptree -p package-name

Resolution:

# Use virtual environment
python -m venv venv
source venv/bin/activate
pip install -r requirements.txt

# Or use constraints
pip install -c constraints.txt -r requirements.txt

Script Reference

Script Purpose
scripts/check-tool.sh Verify tool is installed
scripts/run-taze.sh Run taze with proper flags

Related Tools

Tool Language Purpose
taze Node.js Smart dependency updates
npm-check-updates Node.js Alternative to taze
pip-review Python Interactive pip updates
cargo-edit Rust Cargo dependency management
bundler-audit Ruby Security auditing

Installationen

Installationen 6
Globales Ranking #601 von 601

Sicherheitsprüfung

ath Safe
socket Safe
Warnungen: 0 Bewertung: 90
snyk Medium
EU EU-Hosted Inference API

Power your AI Agents with the best open-source models.

Drop-in OpenAI-compatible API. No data leaves Europe.

Explore Inference API

GLM

GLM 5

$1.00 / $3.20

per M tokens

Kimi

Kimi K2.5

$0.60 / $2.80

per M tokens

MiniMax

MiniMax M2.5

$0.30 / $1.20

per M tokens

Qwen

Qwen3.5 122B

$0.40 / $3.00

per M tokens

So verwenden Sie diesen Skill

1

Install dependency-updater by running npx skills add cachemoney/agent-toolkit --skill dependency-updater in your project directory. Führen Sie den obigen Installationsbefehl in Ihrem Projektverzeichnis aus. Die Skill-Datei wird von GitHub heruntergeladen und in Ihrem Projekt platziert.

2

Keine Konfiguration erforderlich. Ihr KI-Agent (Claude Code, Cursor, Windsurf usw.) erkennt installierte Skills automatisch und nutzt sie als Kontext bei der Code-Generierung.

3

Der Skill verbessert das Verständnis Ihres Agenten für dependency-updater, und hilft ihm, etablierte Muster zu befolgen, häufige Fehler zu vermeiden und produktionsreifen Code zu erzeugen.

Was Sie erhalten

Skills sind Klartext-Anweisungsdateien — kein ausführbarer Code. Sie kodieren Expertenwissen über Frameworks, Sprachen oder Tools, das Ihr KI-Agent liest, um seine Ausgabe zu verbessern. Das bedeutet null Laufzeit-Overhead, keine Abhängigkeitskonflikte und volle Transparenz: Sie können jede Anweisung vor der Installation lesen und prüfen.

Kompatibilität

Dieser Skill funktioniert mit jedem KI-Coding-Agenten, der das skills.sh-Format unterstützt, einschließlich Claude Code (Anthropic), Cursor, Windsurf, Cline, Aider und anderen Tools, die projektbezogene Kontextdateien lesen. Skills sind auf Transportebene framework-agnostisch — der Inhalt bestimmt, für welche Sprache oder welches Framework er gilt.

Data sourced from the skills.sh registry and GitHub. Install counts and security audits are updated regularly.

EU Made in Europe

Chat with 100+ AI Models in one App.

Use Claude, ChatGPT, Gemini alongside with EU-Hosted Models like Deepseek, GLM-5, Kimi K2.5 and many more.

Start for free View pricing