dependency-updater by softaworks/agent-toolkit
npx skills add https://github.com/softaworks/agent-toolkit --skill dependency-updater适用于任何语言的智能依赖管理,具备自动检测和安全更新功能。
update my dependencies
此技能会自动检测您的项目类型并处理后续事宜。
| 触发器 | 示例 |
|---|---|
| 更新依赖 | "update dependencies", "update deps" |
| 检查过时依赖 | "check for outdated packages" |
| 修复依赖问题 | "fix my dependency problems" |
| 安全审计 | "audit dependencies for vulnerabilities" |
| 诊断依赖 | "diagnose dependency issues" |
| 语言 | 包文件 | 更新工具 | 审计工具 |
|---|
广告位招租
在这里展示您的产品或服务
触达数万 AI 开发者,精准高效
| Node.js | package.json | taze | npm audit |
| Python | requirements.txt, pyproject.toml | pip-review | safety, pip-audit |
| Go | go.mod | go get -u | govulncheck |
| Rust | Cargo.toml | cargo update | cargo audit |
| Ruby | Gemfile | bundle update | bundle audit |
| Java | pom.xml, build.gradle | mvn versions:* | mvn dependency:* |
| .NET | *.csproj | dotnet outdated | dotnet list package --vulnerable |
| 更新类型 | 版本变更 | 操作 |
|---|---|---|
| 固定版本 | 无 ^ 或 ~ | 跳过(有意固定) |
| 补丁版本 | x.y.z → x.y.Z | 自动应用 |
| 次要版本 | x.y.z → x.Y.0 | 自动应用 |
| 主要版本 | x.y.z → X.0.0 | 单独提示用户 |
User Request
│
▼
┌─────────────────────────────────────────────────────┐
│ 步骤 1: 检测项目类型 │
│ • 扫描包文件 (package.json, go.mod...) │
│ • 识别包管理器 │
├─────────────────────────────────────────────────────┤
│ 步骤 2: 检查先决条件 │
│ • 验证所需工具是否已安装 │
│ • 如果缺失则建议安装 │
├─────────────────────────────────────────────────────┤
│ 步骤 3: 扫描更新 │
│ • 运行特定语言的过时检查 │
│ • 分类: 主要 / 次要 / 补丁 / 固定版本 │
├─────────────────────────────────────────────────────┤
│ 步骤 4: 自动应用安全更新 │
│ • 自动应用次要和补丁版本更新 │
│ • 报告已更新的内容 │
├─────────────────────────────────────────────────────┤
│ 步骤 5: 提示主要版本更新 │
│ • 对每个主要版本更新进行 AskUserQuestion │
│ • 显示当前 → 新版本 │
├─────────────────────────────────────────────────────┤
│ 步骤 6: 应用已批准的主要版本更新 │
│ • 仅更新已批准的包 │
├─────────────────────────────────────────────────────┤
│ 步骤 7: 完成 │
│ • 运行安装命令 │
│ • 运行安全审计 │
└─────────────────────────────────────────────────────┘
# 检查先决条件
scripts/check-tool.sh taze "npm install -g taze"
# 扫描更新
taze
# 应用次要/补丁版本更新
taze minor --write
# 应用特定的主要版本更新
taze major --write --include pkg1,pkg2
# 支持 Monorepo
taze -r # 递归
# 安全
npm audit
npm audit fix
# 检查过时依赖
pip list --outdated
# 更新所有(小心!)
pip-review --auto
# 更新特定依赖
pip install --upgrade package-name
# 安全
pip-audit
safety check
# 检查过时依赖
go list -m -u all
# 更新所有依赖
go get -u ./...
# 整理
go mod tidy
# 安全
govulncheck ./...
# 检查过时依赖
cargo outdated
# 在 semver 范围内更新
cargo update
# 安全
cargo audit
# 检查过时依赖
bundle outdated
# 更新所有依赖
bundle update
# 更新特定依赖
bundle update --conservative gem-name
# 安全
bundle audit
# 检查过时依赖
mvn versions:display-dependency-updates
# 更新到最新版本
mvn versions:use-latest-releases
# 安全
mvn dependency:tree
mvn dependency-check:check
# 检查过时依赖
dotnet list package --outdated
# 更新特定依赖
dotnet add package PackageName
# 安全
dotnet list package --vulnerable
当依赖关系损坏时,运行诊断:
| 问题 | 症状 | 修复方法 |
|---|---|---|
| 版本冲突 | "无法解析依赖树" | 清理安装,使用覆盖/决议 |
| 对等依赖 | "对等依赖不满足" | 安装所需的对等版本 |
| 安全漏洞 | npm audit 显示问题 | npm audit fix 或手动更新 |
| 未使用的依赖 | 包体积臃肿 | 运行 depcheck(Node)或等效工具 |
| 重复依赖 | 安装了多个版本 | 运行 npm dedupe 或等效工具 |
# Node.js - 彻底重置
rm -rf node_modules package-lock.json
npm cache clean --force
npm install
# Python - 清理虚拟环境
rm -rf venv
python -m venv venv
source venv/bin/activate
pip install -r requirements.txt
# Go - 重置模块
rm go.sum
go mod tidy
为任何项目运行安全检查:
# Node.js
npm audit
npm audit --json | jq '.metadata.vulnerabilities'
# Python
pip-audit
safety check
# Go
govulncheck ./...
# Rust
cargo audit
# Ruby
bundle audit
# .NET
dotnet list package --vulnerable
| 严重性 | 操作 |
|---|---|
| 严重 | 立即修复 |
| 高 | 24 小时内修复 |
| 中 | 1 周内修复 |
| 低 | 下次发布时修复 |
| 避免 | 原因 | 替代方案 |
|---|---|---|
| 更新固定版本 | 有意固定 | 跳过它们 |
| 自动应用主要版本 | 破坏性变更 | 提示用户 |
| 批量提示主要版本 | 丢失上下文 | 单独提示 |
| 跳过锁文件 | 构建不可重现 | 始终提交锁文件 |
| 忽略安全警报 | 漏洞 | 按严重性处理 |
更新后:
此技能通过扫描包文件自动检测项目类型:
| 找到的文件 | 语言 | 包管理器 |
|---|---|---|
package.json | Node.js | npm/yarn/pnpm |
requirements.txt | Python | pip |
pyproject.toml | Python | pip/poetry |
Pipfile | Python | pipenv |
go.mod | Go | go modules |
Cargo.toml | Rust | cargo |
Gemfile | Ruby | bundler |
pom.xml | Java | Maven |
build.gradle | Java/Kotlin | Gradle |
*.csproj | .NET | dotnet |
对于 monorepos,检测顺序很重要:
# 全局安装 taze(推荐)
npm install -g taze
# 或使用 npx
npx taze
# 1. 扫描所有更新
taze
# 2. 应用安全更新(次要 + 补丁)
taze minor --write
# 3. 对每个主要版本,提示用户:
# "将 @types/node 从 ^20.0.0 更新到 ^22.0.0?"
# 如果同意,则添加到批准列表
# 4. 应用已批准的主要版本更新
taze major --write --include approved-pkg1,approved-pkg2
# 5. 安装
npm install # 或 pnpm install / yarn
某些包经常发布主要版本更新但保持向后兼容:
| 包 | 原因 |
|---|---|
lucide-react | 图标库,主要版本是增量的 |
@types/* | 类型定义,通常是安全的 |
主版本.次版本.修订版本 (例如,2.3.1)
主版本: 破坏性变更 - 需要代码更改
次版本: 新功能 - 向后兼容
修订版本: 错误修复 - 向后兼容
| 指定符 | 含义 | 示例 |
|---|---|---|
^1.2.3 | 允许次版本和修订版本更新 | >=1.2.3 <2.0.0 |
~1.2.3 | 仅允许修订版本更新 | >=1.2.3 <1.3.0 |
1.2.3 | 精确(固定) | 仅 1.2.3 |
>=1.2.3 | 至少 | 任何 >=1.2.3 |
* | 任意 | 最新(危险) |
{
"dependencies": {
"critical-lib": "1.2.3", // 关键库使用精确版本
"stable-lib": "~1.2.3", // 稳定库仅允许修订版本更新
"modern-lib": "^1.2.3" // 活跃库允许次版本更新
}
}
诊断:
npm ls package-name # 查看依赖树
npm explain package-name # 解释安装原因
yarn why package-name # Yarn 等效命令
使用覆盖解决:
// package.json
{
"overrides": {
"lodash": "^4.18.0"
}
}
使用决议解决(Yarn):
{
"resolutions": {
"lodash": "^4.18.0"
}
}
诊断:
pip check
pipdeptree -p package-name
解决方法:
# 使用虚拟环境
python -m venv venv
source venv/bin/activate
pip install -r requirements.txt
# 或使用约束文件
pip install -c constraints.txt -r requirements.txt
| 脚本 | 用途 |
|---|---|
scripts/check-tool.sh | 验证工具是否已安装 |
scripts/run-taze.sh | 使用适当的标志运行 taze |
| 工具 | 语言 | 用途 |
|---|---|---|
| taze | Node.js | 智能依赖更新 |
| npm-check-updates | Node.js | taze 的替代方案 |
| pip-review | Python | 交互式 pip 更新 |
| cargo-edit | Rust | Cargo 依赖管理 |
| bundler-audit | Ruby | 安全审计 |
每周安装量
571
仓库
GitHub 星标数
1.2K
首次出现
2026 年 1 月 20 日
安全审计
安装于
codex416
claude-code416
gemini-cli416
cursor416
opencode399
cline397
Smart dependency management for any language with automatic detection and safe updates.
update my dependencies
The skill auto-detects your project type and handles the rest.
| Trigger | Example |
|---|---|
| Update dependencies | "update dependencies", "update deps" |
| Check outdated | "check for outdated packages" |
| Fix dependency issues | "fix my dependency problems" |
| Security audit | "audit dependencies for vulnerabilities" |
| Diagnose deps | "diagnose dependency issues" |
| Language | Package File | Update Tool | Audit Tool |
|---|---|---|---|
| Node.js | package.json | taze | npm audit |
| Python | requirements.txt, pyproject.toml | pip-review | safety, pip-audit |
| Go | go.mod | go get -u | govulncheck |
| Update Type | Version Change | Action |
|---|---|---|
| Fixed | No ^ or ~ | Skip (intentionally pinned) |
| PATCH | x.y.z → x.y.Z | Auto-apply |
| MINOR | x.y.z → x.Y.0 | Auto-apply |
| MAJOR |
User Request
│
▼
┌─────────────────────────────────────────────────────┐
│ Step 1: DETECT PROJECT TYPE │
│ • Scan for package files (package.json, go.mod...) │
│ • Identify package manager │
├─────────────────────────────────────────────────────┤
│ Step 2: CHECK PREREQUISITES │
│ • Verify required tools are installed │
│ • Suggest installation if missing │
├─────────────────────────────────────────────────────┤
│ Step 3: SCAN FOR UPDATES │
│ • Run language-specific outdated check │
│ • Categorize: MAJOR / MINOR / PATCH / Fixed │
├─────────────────────────────────────────────────────┤
│ Step 4: AUTO-APPLY SAFE UPDATES │
│ • Apply MINOR and PATCH automatically │
│ • Report what was updated │
├─────────────────────────────────────────────────────┤
│ Step 5: PROMPT FOR MAJOR UPDATES │
│ • AskUserQuestion for each MAJOR update │
│ • Show current → new version │
├─────────────────────────────────────────────────────┤
│ Step 6: APPLY APPROVED MAJORS │
│ • Update only approved packages │
├─────────────────────────────────────────────────────┤
│ Step 7: FINALIZE │
│ • Run install command │
│ • Run security audit │
└─────────────────────────────────────────────────────┘
# Check prerequisites
scripts/check-tool.sh taze "npm install -g taze"
# Scan for updates
taze
# Apply minor/patch
taze minor --write
# Apply specific majors
taze major --write --include pkg1,pkg2
# Monorepo support
taze -r # recursive
# Security
npm audit
npm audit fix
# Check outdated
pip list --outdated
# Update all (careful!)
pip-review --auto
# Update specific
pip install --upgrade package-name
# Security
pip-audit
safety check
# Check outdated
go list -m -u all
# Update all
go get -u ./...
# Tidy up
go mod tidy
# Security
govulncheck ./...
# Check outdated
cargo outdated
# Update within semver
cargo update
# Security
cargo audit
# Check outdated
bundle outdated
# Update all
bundle update
# Update specific
bundle update --conservative gem-name
# Security
bundle audit
# Check outdated
mvn versions:display-dependency-updates
# Update to latest
mvn versions:use-latest-releases
# Security
mvn dependency:tree
mvn dependency-check:check
# Check outdated
dotnet list package --outdated
# Update specific
dotnet add package PackageName
# Security
dotnet list package --vulnerable
When dependencies are broken, run diagnosis:
| Issue | Symptoms | Fix |
|---|---|---|
| Version Conflict | "Cannot resolve dependency tree" | Clean install, use overrides/resolutions |
| Peer Dependency | "Peer dependency not satisfied" | Install required peer version |
| Security Vuln | npm audit shows issues | npm audit fix or manual update |
| Unused Deps | Bloated bundle | Run depcheck (Node) or equivalent |
| Duplicate Deps | Multiple versions installed | Run npm dedupe or equivalent |
# Node.js - Nuclear reset
rm -rf node_modules package-lock.json
npm cache clean --force
npm install
# Python - Clean virtualenv
rm -rf venv
python -m venv venv
source venv/bin/activate
pip install -r requirements.txt
# Go - Reset modules
rm go.sum
go mod tidy
Run security checks for any project:
# Node.js
npm audit
npm audit --json | jq '.metadata.vulnerabilities'
# Python
pip-audit
safety check
# Go
govulncheck ./...
# Rust
cargo audit
# Ruby
bundle audit
# .NET
dotnet list package --vulnerable
| Severity | Action |
|---|---|
| Critical | Fix immediately |
| High | Fix within 24h |
| Moderate | Fix within 1 week |
| Low | Fix in next release |
| Avoid | Why | Instead |
|---|---|---|
| Update fixed versions | Intentionally pinned | Skip them |
| Auto-apply MAJOR | Breaking changes | Prompt user |
| Batch MAJOR prompts | Loses context | Prompt individually |
| Skip lock file | Irreproducible builds | Always commit lock files |
| Ignore security alerts | Vulnerabilities | Address by severity |
After updates:
The skill auto-detects project type by scanning for package files:
| File Found | Language | Package Manager |
|---|---|---|
package.json | Node.js | npm/yarn/pnpm |
requirements.txt | Python | pip |
pyproject.toml | Python | pip/poetry |
Pipfile | Python | pipenv |
go.mod | Go | go modules |
Detection order matters for monorepos:
# Install taze globally (recommended)
npm install -g taze
# Or use npx
npx taze
# 1. Scan all updates
taze
# 2. Apply safe updates (minor + patch)
taze minor --write
# 3. For each major, prompt user:
# "Update @types/node from ^20.0.0 to ^22.0.0?"
# If yes, add to approved list
# 4. Apply approved majors
taze major --write --include approved-pkg1,approved-pkg2
# 5. Install
npm install # or pnpm install / yarn
Some packages have frequent major bumps but are backward-compatible:
| Package | Reason |
|---|---|
lucide-react | Icon library, majors are additive |
@types/* | Type definitions, usually safe |
MAJOR.MINOR.PATCH (e.g., 2.3.1)
MAJOR: Breaking changes - requires code changes
MINOR: New features - backward compatible
PATCH: Bug fixes - backward compatible
| Specifier | Meaning | Example |
|---|---|---|
^1.2.3 | Minor + Patch OK | >=1.2.3 <2.0.0 |
~1.2.3 | Patch only | >=1.2.3 <1.3.0 |
1.2.3 | Exact (fixed) | Only 1.2.3 |
>=1.2.3 |
{
"dependencies": {
"critical-lib": "1.2.3", // Exact for critical
"stable-lib": "~1.2.3", // Patch only for stable
"modern-lib": "^1.2.3" // Minor OK for active
}
}
Diagnosis:
npm ls package-name # See dependency tree
npm explain package-name # Why installed
yarn why package-name # Yarn equivalent
Resolution with overrides:
// package.json
{
"overrides": {
"lodash": "^4.18.0"
}
}
Resolution with resolutions (Yarn):
{
"resolutions": {
"lodash": "^4.18.0"
}
}
Diagnosis:
pip check
pipdeptree -p package-name
Resolution:
# Use virtual environment
python -m venv venv
source venv/bin/activate
pip install -r requirements.txt
# Or use constraints
pip install -c constraints.txt -r requirements.txt
| Script | Purpose |
|---|---|
scripts/check-tool.sh | Verify tool is installed |
scripts/run-taze.sh | Run taze with proper flags |
| Tool | Language | Purpose |
|---|---|---|
| taze | Node.js | Smart dependency updates |
| npm-check-updates | Node.js | Alternative to taze |
| pip-review | Python | Interactive pip updates |
| cargo-edit | Rust | Cargo dependency management |
| bundler-audit | Ruby | Security auditing |
Weekly Installs
571
Repository
GitHub Stars
1.2K
First Seen
Jan 20, 2026
Security Audits
Gen Agent Trust HubPassSocketPassSnykPass
Installed on
codex416
claude-code416
gemini-cli416
cursor416
opencode399
cline397
agent-browser 浏览器自动化工具 - Vercel Labs 命令行网页操作与测试
136,300 周安装
MCP Builder快速构建Claude工具服务器 - FastMCP Python/TypeScript开发指南
416 周安装
策略对比脚本 - 多策略回测分析与可视化工具,优化交易决策
416 周安装
Spring Boot 3.x OpenAPI 文档生成指南 - SpringDoc集成与Swagger UI配置
416 周安装
React Native 移动端 UI 设计规范与无障碍开发指南 | 最佳实践
417 周安装
CRM自动化工作流:HubSpot/Salesforce/Pipedrive潜在客户管理、交易跟踪与多CRM同步
417 周安装
敏捷产品负责人工具包 - 自动生成用户故事、冲刺规划与优先级排序
417 周安装
| Cargo.toml |
cargo update |
cargo audit |
| Ruby | Gemfile | bundle update | bundle audit |
| Java | pom.xml, build.gradle | mvn versions:* | mvn dependency:* |
| .NET | *.csproj | dotnet outdated | dotnet list package --vulnerable |
x.y.z → X.0.0 |
| Prompt user individually |
Cargo.toml | Rust | cargo |
Gemfile | Ruby | bundler |
pom.xml | Java | Maven |
build.gradle | Java/Kotlin | Gradle |
*.csproj | .NET | dotnet |
| At least |
Any >=1.2.3 |
* | Any | Latest (dangerous) |