Dependency Updater

Smart dependency management for any language with automatic detection and safe updates.

Quick Start

update my dependencies

The skill auto-detects your project type and handles the rest.

Triggers

Trigger

Example

Update dependencies

"update dependencies", "update deps"

Check outdated

"check for outdated packages"

Fix dependency issues

"fix my dependency problems"

Security audit

"audit dependencies for vulnerabilities"

Diagnose deps

"diagnose dependency issues"

Supported Languages

Language

Package File

Update Tool

Audit Tool

Node.js

package.json

taze

npm audit

Python

requirements.txt, pyproject.toml

pip-review

safety, pip-audit

Go

go.mod

go get -u

govulncheck

Rust

Cargo.toml

cargo update

cargo audit

Ruby

Gemfile

bundle update

bundle audit

Java

pom.xml, build.gradle

mvn versions:*

mvn dependency:*

.NET

*.csproj

dotnet outdated

dotnet list package --vulnerable

Quick Reference

Update Type

Version Change

Action

Fixed

No ^ or ~

Skip (intentionally pinned)

PATCH

x.y.z → x.y.Z

Auto-apply

MINOR

x.y.z → x.Y.0

Auto-apply

MAJOR

x.y.z → X.0.0

Prompt user individually

Workflow

User Request

    │

    ▼

┌─────────────────────────────────────────────────────┐

│ Step 1: DETECT PROJECT TYPE                         │

│ • Scan for package files (package.json, go.mod...) │

│ • Identify package manager                          │

├─────────────────────────────────────────────────────┤

│ Step 2: CHECK PREREQUISITES                         │

│ • Verify required tools are installed               │

│ • Suggest installation if missing                   │

├─────────────────────────────────────────────────────┤

│ Step 3: SCAN FOR UPDATES                            │

│ • Run language-specific outdated check              │

│ • Categorize: MAJOR / MINOR / PATCH / Fixed         │

├─────────────────────────────────────────────────────┤

│ Step 4: AUTO-APPLY SAFE UPDATES                     │

│ • Apply MINOR and PATCH automatically               │

│ • Report what was updated                           │

├─────────────────────────────────────────────────────┤

│ Step 5: PROMPT FOR MAJOR UPDATES                    │

│ • AskUserQuestion for each MAJOR update             │

│ • Show current → new version                        │

├─────────────────────────────────────────────────────┤

│ Step 6: APPLY APPROVED MAJORS                       │

│ • Update only approved packages                     │

├─────────────────────────────────────────────────────┤

│ Step 7: FINALIZE                                    │

│ • Run install command                               │

│ • Run security audit                                │

└─────────────────────────────────────────────────────┘

Commands by Language

Node.js (npm/yarn/pnpm)

# Check prerequisites

scripts/check-tool.sh taze "npm install -g taze"

# Scan for updates

taze

# Apply minor/patch

taze minor --write

# Apply specific majors

taze major --write --include pkg1,pkg2

# Monorepo support

taze -r  # recursive

# Security

npm audit

npm audit fix

Python

# Check outdated

pip list --outdated

# Update all (careful!)

pip-review --auto

# Update specific

pip install --upgrade package-name

# Security

pip-audit

safety check

Go

# Check outdated

go list -m -u all

# Update all

go get -u ./...

# Tidy up

go mod tidy

# Security

govulncheck ./...

Rust

# Check outdated

cargo outdated

# Update within semver

cargo update

# Security

cargo audit

Ruby

# Check outdated

bundle outdated

# Update all

bundle update

# Update specific

bundle update --conservative gem-name

# Security

bundle audit

Java (Maven)

# Check outdated

mvn versions:display-dependency-updates

# Update to latest

mvn versions:use-latest-releases

# Security

mvn dependency:tree

mvn dependency-check:check

.NET

# Check outdated

dotnet list package --outdated

# Update specific

dotnet add package PackageName

# Security

dotnet list package --vulnerable

Diagnosis Mode

When dependencies are broken, run diagnosis:

Common Issues & Fixes

Issue

Symptoms

Fix

Version Conflict

"Cannot resolve dependency tree"

Clean install, use overrides/resolutions

Peer Dependency

"Peer dependency not satisfied"

Install required peer version

Security Vuln

npm audit shows issues

npm audit fix or manual update

Unused Deps

Bloated bundle

Run depcheck (Node) or equivalent

Duplicate Deps

Multiple versions installed

Run npm dedupe or equivalent

Emergency Fixes

# Node.js - Nuclear reset

rm -rf node_modules package-lock.json

npm cache clean --force

npm install

# Python - Clean virtualenv

rm -rf venv

python -m venv venv

source venv/bin/activate

pip install -r requirements.txt

# Go - Reset modules

rm go.sum

go mod tidy

Security Audit

Run security checks for any project:

# Node.js

npm audit

npm audit --json | jq '.metadata.vulnerabilities'

# Python

pip-audit

safety check

# Go

govulncheck ./...

# Rust

cargo audit

# Ruby

bundle audit

# .NET

dotnet list package --vulnerable

Severity Response

Severity

Action

Critical

Fix immediately

High

Fix within 24h

Moderate

Fix within 1 week

Low

Fix in next release

Anti-Patterns

Avoid

Why

Instead

Update fixed versions

Intentionally pinned

Skip them

Auto-apply MAJOR

Breaking changes

Prompt user

Batch MAJOR prompts

Loses context

Prompt individually

Skip lock file

Irreproducible builds

Always commit lock files

Ignore security alerts

Vulnerabilities

Address by severity

Verification Checklist

After updates:

• Updates scanned without errors

• MINOR/PATCH auto-applied

• MAJOR updates prompted individually

• Fixed versions untouched

• Lock file updated

• Install command ran

• Security audit passed (or issues noted)

The skill auto-detects project type by scanning for package files:

File Found

Language

Package Manager

package.json

Node.js

npm/yarn/pnpm

requirements.txt

Python

pip

pyproject.toml

Python

pip/poetry

Pipfile

Python

pipenv

go.mod

Go

go modules

Cargo.toml

Rust

cargo

Gemfile

Ruby

bundler

pom.xml

Java

Maven

build.gradle

Java/Kotlin

Gradle

*.csproj

.NET

dotnet

Detection order matters for monorepos:

• Check current directory first

• Then check for workspace/monorepo patterns

• Offer to run recursively if applicable

Prerequisites

# Install taze globally (recommended)

npm install -g taze

# Or use npx

npx taze

Smart Update Flow

# 1. Scan all updates

taze

# 2. Apply safe updates (minor + patch)

taze minor --write

# 3. For each major, prompt user:

#    "Update @types/node from ^20.0.0 to ^22.0.0?"

#    If yes, add to approved list

# 4. Apply approved majors

taze major --write --include approved-pkg1,approved-pkg2

# 5. Install

npm install  # or pnpm install / yarn

Auto-Approve List

Some packages have frequent major bumps but are backward-compatible:

Package

Reason

lucide-react

Icon library, majors are additive

@types/*

Type definitions, usually safe

Semantic Versioning

MAJOR.MINOR.PATCH (e.g., 2.3.1)

MAJOR: Breaking changes - requires code changes

MINOR: New features - backward compatible

PATCH: Bug fixes - backward compatible

Range Specifiers

Specifier

Meaning

Example

^1.2.3

Minor + Patch OK

>=1.2.3 <2.0.0

~1.2.3

Patch only

>=1.2.3 <1.3.0

1.2.3

Exact (fixed)

Only 1.2.3

>=1.2.3

At least

Any >=1.2.3

*

Any

Latest (dangerous)

Recommended Strategy

{

  "dependencies": {

    "critical-lib": "1.2.3",      // Exact for critical

    "stable-lib": "~1.2.3",       // Patch only for stable

    "modern-lib": "^1.2.3"        // Minor OK for active

  }

}

Node.js Conflicts

Diagnosis:

npm ls package-name      # See dependency tree

npm explain package-name # Why installed

yarn why package-name    # Yarn equivalent

Resolution with overrides:

// package.json

{

  "overrides": {

    "lodash": "^4.18.0"

  }

}

Resolution with resolutions (Yarn):

{

  "resolutions": {

    "lodash": "^4.18.0"

  }

}

Python Conflicts

Diagnosis:

pip check

pipdeptree -p package-name

Resolution:

# Use virtual environment

python -m venv venv

source venv/bin/activate

pip install -r requirements.txt

# Or use constraints

pip install -c constraints.txt -r requirements.txt

Script Reference

Script

Purpose

scripts/check-tool.sh

Verify tool is installed

scripts/run-taze.sh

Run taze with proper flags

Related Tools

Tool

Language

Purpose

taze

Node.js

Smart dependency updates

npm-check-updates

Node.js

Alternative to taze

pip-review

Python

Interactive pip updates

cargo-edit

Rust

Cargo dependency management

bundler-audit

Ruby

Security auditing