Dependency Update Manager

Overview

Dependency Update Manager keeps your project's dependencies secure, current, and clean. It audits for vulnerabilities, plans safe update strategies, and handles the code changes required by major version upgrades.

Key Features

• Vulnerability Scanning: Checks all dependencies against CVE databases (NVD, GitHub Advisory, npm audit, pip-audit). Reports severity levels and provides remediation guidance for each finding.
• Safe Update Planning: For major version upgrades, analyzes changelogs and migration guides to identify breaking changes that affect your code. Creates a step-by-step migration plan.
• Unused Dependency Detection: Scans your codebase for import statements and require calls to identify dependencies that are installed but never used, reducing bundle size and attack surface.
• License Compliance: Audits all direct and transitive dependency licenses against your project's allowed license list. Flags GPL, AGPL, or other copyleft licenses that may conflict with proprietary code.

Package Manager Support

npm, yarn, and pnpm for JavaScript/TypeScript. pip and poetry for Python. Cargo for Rust. Go modules for Go. Each uses the native tooling for accurate dependency resolution.

Update Strategy

The skill groups updates by risk level: patch updates (apply immediately), minor updates (review changelogs), and major updates (follow migration plan). Each group can be applied independently.