wehub-resource-sync
291 lines
8.2 KiB
Markdown
291 lines
8.2 KiB
Markdown
# Dependency Updater
|
|
|
|
Smart dependency management for any programming language with automatic detection and safe updates.
|
|
|
|
## Purpose
|
|
|
|
The Dependency Updater skill provides intelligent, language-agnostic dependency management that:
|
|
|
|
- **Auto-detects your project type** by scanning for package files (package.json, go.mod, Cargo.toml, etc.)
|
|
- **Applies safe updates automatically** (minor and patch versions)
|
|
- **Prompts for major updates individually** to prevent breaking changes
|
|
- **Respects intentionally pinned versions** by skipping fixed dependencies
|
|
- **Runs security audits** to identify vulnerabilities
|
|
- **Diagnoses and fixes** common dependency issues
|
|
|
|
This skill eliminates the manual work of checking for outdated packages across different ecosystems while maintaining safety through semantic versioning awareness.
|
|
|
|
## When to Use
|
|
|
|
Use this skill when you want to:
|
|
|
|
| Scenario | Trigger Phrases |
|
|
|----------|-----------------|
|
|
| Update dependencies | "update dependencies", "update deps", "update my packages" |
|
|
| Check for outdated packages | "check for outdated packages", "what packages need updating" |
|
|
| Fix dependency problems | "fix my dependency problems", "resolve dependency conflicts" |
|
|
| Security audit | "audit dependencies for vulnerabilities", "check for security issues" |
|
|
| Diagnose issues | "diagnose dependency issues", "why won't my dependencies install" |
|
|
|
|
**Quick Start:**
|
|
```
|
|
update my dependencies
|
|
```
|
|
|
|
The skill will auto-detect your project type and handle everything.
|
|
|
|
## Supported Languages
|
|
|
|
| Language | Package File | Update Tool | Audit Tool |
|
|
|----------|--------------|-------------|------------|
|
|
| Node.js | package.json | `taze` | `npm audit` |
|
|
| Python | requirements.txt, pyproject.toml, Pipfile | `pip-review` | `safety`, `pip-audit` |
|
|
| Go | go.mod | `go get -u` | `govulncheck` |
|
|
| Rust | Cargo.toml | `cargo update` | `cargo audit` |
|
|
| Ruby | Gemfile | `bundle update` | `bundle audit` |
|
|
| Java | pom.xml, build.gradle | `mvn versions:*` | `mvn dependency-check:check` |
|
|
| .NET | *.csproj | `dotnet outdated` | `dotnet list package --vulnerable` |
|
|
|
|
## How It Works
|
|
|
|
The skill follows a systematic 7-step workflow:
|
|
|
|
```
|
|
1. DETECT PROJECT TYPE
|
|
Scan for package files and identify the package manager
|
|
|
|
2. CHECK PREREQUISITES
|
|
Verify required tools are installed, suggest installation if missing
|
|
|
|
3. SCAN FOR UPDATES
|
|
Run language-specific outdated checks and categorize updates
|
|
|
|
4. AUTO-APPLY SAFE UPDATES
|
|
Automatically apply MINOR and PATCH updates
|
|
|
|
5. PROMPT FOR MAJOR UPDATES
|
|
Ask user about each MAJOR update individually (breaking changes)
|
|
|
|
6. APPLY APPROVED MAJORS
|
|
Update only the packages the user approved
|
|
|
|
7. FINALIZE
|
|
Run install command and security audit
|
|
```
|
|
|
|
### Update Classification
|
|
|
|
| Update Type | Version Change | Action |
|
|
|-------------|----------------|--------|
|
|
| **Fixed** | No `^` or `~` prefix | Skip (intentionally pinned) |
|
|
| **PATCH** | `1.2.3` to `1.2.4` | Auto-apply |
|
|
| **MINOR** | `1.2.3` to `1.3.0` | Auto-apply |
|
|
| **MAJOR** | `1.2.3` to `2.0.0` | Prompt user individually |
|
|
|
|
## Key Features
|
|
|
|
### Language-Agnostic Detection
|
|
|
|
The skill automatically identifies your project by scanning for common package files:
|
|
|
|
- `package.json` - Node.js (npm/yarn/pnpm)
|
|
- `requirements.txt` / `pyproject.toml` / `Pipfile` - Python
|
|
- `go.mod` - Go
|
|
- `Cargo.toml` - Rust
|
|
- `Gemfile` - Ruby
|
|
- `pom.xml` / `build.gradle` - Java/Kotlin
|
|
- `*.csproj` - .NET
|
|
|
|
### Safe-by-Default Updates
|
|
|
|
- Minor and patch updates are applied automatically (backward compatible)
|
|
- Major updates require explicit approval (may contain breaking changes)
|
|
- Fixed/pinned versions are never modified
|
|
|
|
### Security Auditing
|
|
|
|
Built-in security vulnerability scanning for each ecosystem:
|
|
- Identifies vulnerabilities by severity (Critical, High, Moderate, Low)
|
|
- Recommends appropriate response times based on severity
|
|
- Integrates with ecosystem-specific audit tools
|
|
|
|
### Dependency Diagnosis
|
|
|
|
Troubleshoots common issues:
|
|
- Version conflicts
|
|
- Peer dependency problems
|
|
- Security vulnerabilities
|
|
- Unused dependencies
|
|
- Duplicate packages
|
|
|
|
## Usage Examples
|
|
|
|
### Basic Update
|
|
|
|
```
|
|
update my dependencies
|
|
```
|
|
|
|
The skill will scan your project, apply safe updates, and prompt for major versions.
|
|
|
|
### Security-Focused Audit
|
|
|
|
```
|
|
audit my dependencies for security issues
|
|
```
|
|
|
|
Runs security scanners and reports vulnerabilities by severity.
|
|
|
|
### Diagnose Problems
|
|
|
|
```
|
|
my npm install keeps failing, diagnose the issue
|
|
```
|
|
|
|
Analyzes dependency tree, identifies conflicts, and suggests fixes.
|
|
|
|
### Node.js Specific
|
|
|
|
```bash
|
|
# Check prerequisites
|
|
scripts/check-tool.sh taze "npm install -g taze"
|
|
|
|
# Run taze directly
|
|
scripts/run-taze.sh
|
|
|
|
# Run in monorepo mode
|
|
scripts/run-taze.sh -r
|
|
```
|
|
|
|
## Prerequisites
|
|
|
|
### General Requirements
|
|
|
|
Each language ecosystem requires its standard package manager:
|
|
- Node.js: npm, yarn, or pnpm
|
|
- Python: pip
|
|
- Go: go modules
|
|
- Rust: cargo
|
|
- Ruby: bundler
|
|
- Java: Maven or Gradle
|
|
- .NET: dotnet CLI
|
|
|
|
### Recommended Tools
|
|
|
|
For the best experience, install these optional but recommended tools:
|
|
|
|
| Language | Tool | Install Command |
|
|
|----------|------|-----------------|
|
|
| Node.js | taze | `npm install -g taze` |
|
|
| Python | pip-review | `pip install pip-review` |
|
|
| Python | pip-audit | `pip install pip-audit` |
|
|
| Go | govulncheck | `go install golang.org/x/vuln/cmd/govulncheck@latest` |
|
|
| Rust | cargo-audit | `cargo install cargo-audit` |
|
|
| Ruby | bundler-audit | `gem install bundler-audit` |
|
|
|
|
## Output
|
|
|
|
### Update Summary
|
|
|
|
After running, you will see:
|
|
- List of auto-applied minor/patch updates
|
|
- Prompts for each major update decision
|
|
- Final package count and versions
|
|
- Security audit results
|
|
|
|
### Security Audit Results
|
|
|
|
Vulnerabilities are reported with severity levels:
|
|
|
|
| Severity | Recommended Response |
|
|
|----------|---------------------|
|
|
| Critical | Fix immediately |
|
|
| High | Fix within 24 hours |
|
|
| Moderate | Fix within 1 week |
|
|
| Low | Fix in next release |
|
|
|
|
## Best Practices
|
|
|
|
### Do
|
|
|
|
- **Commit lock files** - Always commit package-lock.json, yarn.lock, go.sum, etc.
|
|
- **Review major updates** - Check changelogs before approving major version bumps
|
|
- **Run tests after updates** - Verify your application still works
|
|
- **Address security issues promptly** - Prioritize by severity level
|
|
- **Use version ranges appropriately** - `^` for active libraries, `~` for stable ones, exact for critical dependencies
|
|
|
|
### Avoid
|
|
|
|
- **Don't auto-approve all majors** - Breaking changes require code modifications
|
|
- **Don't ignore security alerts** - Vulnerabilities can be exploited
|
|
- **Don't update fixed versions** - They were pinned for a reason
|
|
- **Don't skip the lock file** - It ensures reproducible builds
|
|
|
|
### Version Range Strategy
|
|
|
|
```json
|
|
{
|
|
"dependencies": {
|
|
"critical-lib": "1.2.3", // Exact for critical dependencies
|
|
"stable-lib": "~1.2.3", // Patch only for stable libraries
|
|
"modern-lib": "^1.2.3" // Minor OK for actively maintained
|
|
}
|
|
}
|
|
```
|
|
|
|
## Emergency Fixes
|
|
|
|
When dependencies are completely broken:
|
|
|
|
### Node.js - Nuclear Reset
|
|
|
|
```bash
|
|
rm -rf node_modules package-lock.json
|
|
npm cache clean --force
|
|
npm install
|
|
```
|
|
|
|
### Python - Clean Virtual Environment
|
|
|
|
```bash
|
|
rm -rf venv
|
|
python -m venv venv
|
|
source venv/bin/activate
|
|
pip install -r requirements.txt
|
|
```
|
|
|
|
### Go - Reset Modules
|
|
|
|
```bash
|
|
rm go.sum
|
|
go mod tidy
|
|
```
|
|
|
|
## Verification Checklist
|
|
|
|
After running updates, verify:
|
|
|
|
- [ ] Updates scanned without errors
|
|
- [ ] Minor/patch updates auto-applied
|
|
- [ ] Major updates prompted individually
|
|
- [ ] Fixed versions remained untouched
|
|
- [ ] Lock file updated
|
|
- [ ] Install command succeeded
|
|
- [ ] Security audit passed (or issues noted)
|
|
- [ ] Tests pass
|
|
- [ ] Application runs correctly
|
|
|
|
## Related Tools
|
|
|
|
| Tool | Language | Purpose | Link |
|
|
|------|----------|---------|------|
|
|
| taze | Node.js | Smart dependency updates | [GitHub](https://github.com/antfu-collective/taze) |
|
|
| npm-check-updates | Node.js | Alternative to taze | [GitHub](https://github.com/raineorshine/npm-check-updates) |
|
|
| pip-review | Python | Interactive pip updates | [GitHub](https://github.com/jgonggrijp/pip-review) |
|
|
| cargo-edit | Rust | Cargo dependency management | [GitHub](https://github.com/killercup/cargo-edit) |
|
|
| bundler-audit | Ruby | Security auditing | [GitHub](https://github.com/rubysec/bundler-audit) |
|
|
|
|
## License
|
|
|
|
MIT
|