依赖项优化协调器：自动化升级npm、NuGet、Python依赖，提升项目安全与性能

ln-820-dependency-optimization-coordinator by levnikolaevich/claude-code-skills

72 周安装量

245 GitHub Stars

安装命令

npx skills add https://github.com/levnikolaevich/claude-code-skills --skill ln-820-dependency-optimization-coordinator

项目管理自动化开发运维

🇨🇳中文介绍

路径说明： 文件路径（shared/、references/、../ln-*）是相对于技能仓库根目录的。如果在当前工作目录未找到，请定位此 SKILL.md 文件所在的目录，然后向上返回一级以找到仓库根目录。如果缺少 shared/ 目录，请通过 WebFetch 从 https://raw.githubusercontent.com/levnikolaevich/claude-code-skills/master/skills/{path} 获取文件。

ln-820-dependency-optimization-coordinator

类型： L2 领域协调器 类别： 8XX 优化 父级： ln-700-project-bootstrap

通过检测包管理器并委托给相应的 L3 工作器来协调依赖项升级。

概述

方面	详情

广告位招租

在这里展示您的产品或服务

触达数万 AI 开发者，精准高效

联系我们

检查项	方法	阻止条件
未提交的更改	`git status --porcelain`	输出非空
创建备份分支	`git checkout -b upgrade-backup-{timestamp}`	失败
锁定文件存在	检查锁定文件	缺失（仅警告）

阶段 1：检测包管理器

包管理器	指示文件	工作器
npm	package.json + package-lock.json	ln-821
yarn	package.json + yarn.lock	ln-821
pnpm	package.json + pnpm-lock.yaml	ln-821
nuget	*.csproj 文件	ln-822
pip	requirements.txt	ln-823
poetry	pyproject.toml + poetry.lock	ln-823
pipenv	Pipfile + Pipfile.lock	ln-823

阶段 2：安全审计（预检）

包管理器	命令	阻止升级
npm	`npm audit --audit-level=high`	仅严重漏洞
pip	`pip-audit --json`	仅严重漏洞
nuget	`dotnet list package --vulnerable`	仅严重漏洞

选项	默认值	描述
minimumReleaseAge	14 天	跳过发布时间 < 14 天的包
ignoreReleaseAge	false	用于紧急安全补丁的覆盖选项

根据 Renovate 最佳实践：等待 14 天可以让注册表有时间拉取恶意包。

阶段 3：委托给工作器

关键： 所有委托都使用 subagent_type: "general-purpose" 和 isolation: "worktree" 的 Agent 工具——每个工作器根据 shared/references/git_worktree_fallback.md 创建自己的分支。

提示词模板：

Agent(description: "Upgrade deps via ln-82X",
     prompt: "Execute dependency upgrade worker.

Step 1: Invoke worker:
  Skill(skill: \"ln-82X-{worker}\")

CONTEXT:
{delegationContext}",
     subagent_type: "general-purpose",
     isolation: "worktree")

❌ 不经过 Agent 包装直接调用 Skill 工具
❌ 任何绕过子代理上下文隔离的执行

每个工作器接收标准化的上下文：

字段	类型	描述
projectPath	string	项目的绝对路径
packageManager	enum	npm, yarn, pnpm, nuget, pip, poetry, pipenv
options.upgradeType	enum	major, minor, patch
options.allowBreaking	bool	允许破坏性变更
options.testAfterUpgrade	bool	升级后运行测试

包管理器	工作器	备注
npm, yarn, pnpm	ln-821-npm-upgrader	处理所有 Node.js
nuget	ln-822-nuget-upgrader	处理 .NET 项目
pip, poetry, pipenv	ln-823-pip-upgrader	处理所有 Python

阶段 4：收集结果

每个工作器产生一个独立的分支。协调器汇总分支报告。

工作器	分支模式	内容
ln-821	`upgrade/ln-821-npm-{ts}`	npm/yarn/pnpm 依赖项升级
ln-822	`upgrade/ln-822-nuget-{ts}`	NuGet 依赖项升级
ln-823	`upgrade/ln-823-pip-{ts}`	pip/poetry/pipenv 依赖项升级

字段	类型	描述
worker	string	ln-821, ln-822, 或 ln-823
status	enum	success, partial, failed
branch	string	工作器的结果分支名称
upgrades[]	array	已升级包的列表
upgrades[].package	string	包名
upgrades[].from	string	先前版本
upgrades[].to	string	新版本
upgrades[].breaking	bool	是否为破坏性变更
warnings[]	array	非阻塞性警告
errors[]	array	阻塞性错误

阶段 5：汇总报告

每个工作器在其分支中独立验证（构建、测试由工作器自身运行）。协调器不重新运行验证或回滚包。

构建/测试失败的分支在报告中记录为 "failed"
用户独立审查失败的分支

阶段 6：报告摘要

字段	类型	描述
totalPackages	int	分析的总包数
upgraded	int	成功升级数
skipped	int	已是最新版本数
failed	int	已回滚数
breakingChanges	int	主版本升级数
buildVerified	bool	升级后构建通过
duration	string	总耗时

Options:
  # Upgrade scope
  upgradeType: major          # major | minor | patch

  # Breaking changes
  allowBreaking: true
  autoMigrate: true           # Apply known migrations

  # Security
  auditLevel: high            # none | low | moderate | high | critical
  minimumReleaseAge: 14       # days, 0 to disable
  blockOnVulnerability: true

  # Scope
  skipDev: false              # Include devDependencies
  skipOptional: true          # Skip optional deps

  # Verification
  testAfterUpgrade: true
  buildAfterUpgrade: true

  # Rollback
  rollbackOnFailure: true

错误	恢复措施
对等依赖冲突	尝试 --legacy-peer-deps
构建失败	回滚包，继续
网络超时	重试 3 次

错误	操作
未找到包管理器	跳过此步骤
所有构建都失败	报告给父级，建议手动审查

TodoWrite 格式（强制）：

- Invoke ln-821-npm-upgrader (in_progress)
- Invoke ln-822-nuget-upgrader (pending)
- Invoke ln-823-pip-upgrader (pending)
- Aggregate reports (pending)

工作器调用（强制）

阶段	工作器	上下文
3	ln-821-npm-upgrader	隔离（Agent 工具）—— npm/yarn/pnpm 依赖项升级
3	ln-822-nuget-upgrader	隔离（Agent 工具）—— NuGet 依赖项升级
3	ln-823-pip-upgrader	隔离（Agent 工具）—— pip/poetry/pipenv 依赖项升级

所有工作器： 通过 isolation: "worktree" 的 Agent 工具调用——每个工作器创建自己的分支。

预检通过（干净的 git 状态）
从指示文件中检测到所有包管理器
按管理器完成安全审计（严重漏洞阻止升级）
工作器通过工作树隔离委托（isolation: "worktree"）
每个工作器产生独立分支，推送到远程
协调器报告汇总每个工作器的结果（分支、升级、状态）

阶段 7：元分析

强制阅读： 加载 shared/references/meta_analysis_protocol.md

技能类型：optimization-coordinator。在所有阶段完成后运行。使用 optimization-coordinator 格式输出到聊天。

版本： 1.1.0 最后更新： 2026-01-10

🇺🇸English

Paths: File paths (shared/, references/, ../ln-*) are relative to skills repo root. If not found at CWD, locate this SKILL.md directory and go up one level for repo root. If shared/ is missing, fetch files via WebFetch from https://raw.githubusercontent.com/levnikolaevich/claude-code-skills/master/skills/{path}.

ln-820-dependency-optimization-coordinator

Type: L2 Domain Coordinator Category: 8XX Optimization Parent: ln-700-project-bootstrap

Coordinates dependency upgrades by detecting package managers and delegating to appropriate L3 workers.

Overview

Aspect	Details
Input	Detected stack from ln-700
Output	All dependencies upgraded to latest compatible versions
Workers	ln-821 (npm), ln-822 (nuget), ln-823 (pip)

Workflow

Phases: Pre-flight → Detect → Security Audit → Delegate → Collect → Verify → Report

Phase 0: Pre-flight Checks

Verify project state before starting upgrade.

Check	Method	Block if
Uncommitted changes	`git status --porcelain`	Non-empty output
Create backup branch	`git checkout -b upgrade-backup-{timestamp}`	Failure
Lock file exists	Check for lock file	Missing (warn only)

Skip upgrade if uncommitted changes exist. User must commit or stash first.

Phase 1: Detect Package Managers

Detection Rules

Package Manager	Indicator Files	Worker
npm	package.json + package-lock.json	ln-821
yarn	package.json + yarn.lock	ln-821
pnpm	package.json + pnpm-lock.yaml	ln-821
nuget	*.csproj files	ln-822
pip	requirements.txt	ln-823
poetry	pyproject.toml + poetry.lock	ln-823
pipenv	Pipfile + Pipfile.lock	ln-823

Phase 2: Security Audit (Pre-flight)

Security Checks

Package Manager	Command	Block Upgrade
npm	`npm audit --audit-level=high`	Critical only
pip	`pip-audit --json`	Critical only
nuget	`dotnet list package --vulnerable`	Critical only

Release Age Check

Option	Default	Description
minimumReleaseAge	14 days	Skip packages released < 14 days ago
ignoreReleaseAge	false	Override for urgent security patches

Per Renovate best practices: waiting 14 days gives registries time to pull malicious packages.

Phase 3: Delegate to Workers

CRITICAL: All delegations use Agent tool with subagent_type: "general-purpose" and isolation: "worktree" — each worker creates its own branch per shared/references/git_worktree_fallback.md.

Prompt template:

Agent(description: "Upgrade deps via ln-82X",
     prompt: "Execute dependency upgrade worker.

Step 1: Invoke worker:
  Skill(skill: \"ln-82X-{worker}\")

CONTEXT:
{delegationContext}",
     subagent_type: "general-purpose",
     isolation: "worktree")

Anti-Patterns:

❌ Direct Skill tool invocation without Agent wrapper
❌ Any execution bypassing subagent context isolation

Delegation Context

Each worker receives standardized context:

Field	Type	Description
projectPath	string	Absolute path to project
packageManager	enum	npm, yarn, pnpm, nuget, pip, poetry, pipenv
options.upgradeType	enum	major, minor, patch
options.allowBreaking	bool	Allow breaking changes
options.testAfterUpgrade	bool	Run tests after upgrade

Worker Selection

Package Manager	Worker	Notes
npm, yarn, pnpm	ln-821-npm-upgrader	Handles all Node.js
nuget	ln-822-nuget-upgrader	Handles .NET projects
pip, poetry, pipenv	ln-823-pip-upgrader	Handles all Python

Phase 4: Collect Results

Each worker produces an isolated branch. Coordinator aggregates branch reports.

Worker Branches

Worker	Branch Pattern	Contents
ln-821	`upgrade/ln-821-npm-{ts}`	npm/yarn/pnpm dependency upgrades
ln-822	`upgrade/ln-822-nuget-{ts}`	NuGet dependency upgrades
ln-823	`upgrade/ln-823-pip-{ts}`	pip/poetry/pipenv dependency upgrades

Result Schema

Field	Type	Description
worker	string	ln-821, ln-822, or ln-823
status	enum	success, partial, failed
branch	string	Worker's result branch name
upgrades[]	array	List of upgraded packages
upgrades[].package	string	Package name
upgrades[].from	string	Previous version
upgrades[].to	string	New version
upgrades[].breaking	bool	Is breaking change
warnings[]	array	Non-blocking warnings
errors[]	array

Phase 5: Aggregate Reports

Each worker verified independently in its branch (build, tests run by worker itself). Coordinator does NOT rerun verification or rollback packages.

On Failure

Branch with failing build/tests logged as "failed" in report
User reviews failed branch independently

Phase 6: Report Summary

Report Schema

Field	Type	Description
totalPackages	int	Total packages analyzed
upgraded	int	Successfully upgraded
skipped	int	Already latest
failed	int	Rolled back
breakingChanges	int	Major version upgrades
buildVerified	bool	Build passed after upgrade
duration	string	Total time

Configuration

Options:
  # Upgrade scope
  upgradeType: major          # major | minor | patch

  # Breaking changes
  allowBreaking: true
  autoMigrate: true           # Apply known migrations

  # Security
  auditLevel: high            # none | low | moderate | high | critical
  minimumReleaseAge: 14       # days, 0 to disable
  blockOnVulnerability: true

  # Scope
  skipDev: false              # Include devDependencies
  skipOptional: true          # Skip optional deps

  # Verification
  testAfterUpgrade: true
  buildAfterUpgrade: true

  # Rollback
  rollbackOnFailure: true

Error Handling

Recoverable Errors

Error	Recovery
Peer dependency conflict	Try --legacy-peer-deps
Build failure	Rollback package, continue
Network timeout	Retry 3 times

Fatal Errors

Error	Action
No package managers found	Skip this step
All builds fail	Report to parent, suggest manual review

References

TodoWrite format (mandatory):

- Invoke ln-821-npm-upgrader (in_progress)
- Invoke ln-822-nuget-upgrader (pending)
- Invoke ln-823-pip-upgrader (pending)
- Aggregate reports (pending)

Worker Invocation (MANDATORY)

Phase	Worker	Context
3	ln-821-npm-upgrader	Isolated (Agent tool) — npm/yarn/pnpm dependency upgrades
3	ln-822-nuget-upgrader	Isolated (Agent tool) — NuGet dependency upgrades
3	ln-823-pip-upgrader	Isolated (Agent tool) — pip/poetry/pipenv dependency upgrades

All workers: Invoke via Agent tool with isolation: "worktree" — each worker creates its own branch.

Definition of Done

Pre-flight checks passed (clean git state)
All package managers detected from indicator files
Security audit completed per manager (critical vulns block upgrade)
Workers delegated with worktree isolation (isolation: "worktree")
Each worker produces isolated branch, pushed to remote
Coordinator report aggregates per-worker results (branch, upgrades, status)

Phase 7: Meta-Analysis

MANDATORY READ: Load shared/references/meta_analysis_protocol.md

Skill type: optimization-coordinator. Run after all phases complete. Output to chat using the optimization-coordinator format.

Version: 1.1.0 Last Updated: 2026-01-10

Weekly Installs

Repository

levnikolaevich/…e-skills

GitHub Stars

245

First Seen

Mar 8, 2026

Security Audits

Gen Agent Trust HubPass SocketWarn SnykWarn

Installed on

cursor69

github-copilot68

codex68

gemini-cli68

claude-code68

amp68

Azure Data Explorer (Kusto) 查询技能：KQL数据分析、日志遥测与时间序列处理

138,800 周安装

依赖项优化协调器：自动化升级npm、NuGet、Python依赖，提升项目安全与性能

🇨🇳中文介绍

ln-820-dependency-optimization-coordinator

概述

相关 Skills

工作流程

阶段 0：预检

阶段 1：检测包管理器

检测规则

阶段 2：安全审计（预检）

安全检查

发布年龄检查

阶段 3：委托给工作器

委托上下文

工作器选择

阶段 4：收集结果

工作器分支

结果模式

阶段 5：汇总报告

失败处理

阶段 6：报告摘要

报告模式

配置

错误处理

可恢复错误

致命错误

参考资料

工作器调用（强制）

完成定义

阶段 7：元分析

🇺🇸English

ln-820-dependency-optimization-coordinator

Overview

Workflow

Phase 0: Pre-flight Checks

Phase 1: Detect Package Managers

Detection Rules

Phase 2: Security Audit (Pre-flight)

Security Checks

Release Age Check

Phase 3: Delegate to Workers

Delegation Context

Worker Selection

Phase 4: Collect Results

Worker Branches

Result Schema

Phase 5: Aggregate Reports

On Failure

Phase 6: Report Summary

Report Schema

Configuration

Error Handling

Recoverable Errors

Fatal Errors

References

Worker Invocation (MANDATORY)

Definition of Done

Phase 7: Meta-Analysis

最新 Skills