Deps Skill

Quick Ref:

$deps audit

|

$deps update [--major|--minor|--patch]

|

$deps vuln

|

$deps license

YOU MUST EXECUTE THIS WORKFLOW. Do not just describe it.

Modes

$deps audit

$deps update [--major|--minor|--patch]

$deps vuln

$deps license

Default (bare

$deps

Step 0: Detect Ecosystem

Scan the working directory for manifest files. Multiple ecosystems may coexist.

go.mod

go.sum

package.json

package-lock.json

yarn.lock

pnpm-lock.yaml

pyproject.toml

requirements.txt

requirements.txt

poetry.lock

Cargo.toml

Cargo.lock

Gemfile

Gemfile.lock

# Detect all ecosystems present
for f in go.mod package.json pyproject.toml requirements.txt Cargo.toml Gemfile; do
  [[ -f "$f" ]] && echo "FOUND: $f"
done

If no manifest is found, stop and report: "No supported dependency manifest detected."

Step 1: Audit Current State

Run the ecosystem-appropriate commands. Capture all output for classification.

Go

go list -m -u all          # List all modules, flag available updates
govulncheck ./...           # Vulnerability scan against Go vuln DB
go mod tidy                 # Clean up unused deps (dry-run first)

Node

npm audit                   # Known vulnerabilities
npm outdated                # Available updates (current vs wanted vs latest)
npx license-checker-webpack-plugin --out /dev/stdout 2>/dev/null || npx license-checker --json

Python

pip-audit                   # Vulnerability scan (install: pip install pip-audit)
pip list --outdated         # Available updates
pip-licenses 2>/dev/null || echo "pip-licenses not installed"

Rust

cargo audit                 # Vulnerability scan (install: cargo install cargo-audit)
cargo outdated              # Available updates (install: cargo install cargo-outdated)
cargo license 2>/dev/null || echo "cargo-license not installed"

Ruby

bundle audit check          # Vulnerability scan (install: gem install bundler-audit)
bundle outdated             # Available updates

Step 2: Classify Findings

Sort every finding into exactly one severity tier.

Output a summary table:

SEVERITY   PACKAGE            CURRENT   AVAILABLE   REASON
Critical   example-lib        1.2.3     1.2.8       CVE-2025-XXXXX (RCE)
High       some-framework     3.1.0     4.2.0       Security advisory SA-2025-YYY
Medium     helper-pkg         2.0.1     2.3.0       3 minor versions behind
Low        util-lib           1.0.0     1.0.1       Patch release

Step 3: Update Strategy

Choose strategy based on the update scope requested (or default to the classification).

Patch updates (

--patch

or Low severity)

• Batch all patch updates together.
• Run full test suite once after the batch.
• Single commit:

  chore(deps): batch patch updates

  .

Minor updates (

--minor

or Medium severity)

• Update one dependency at a time.
• Run tests after each update.
• Individual commits:

  chore(deps): update <pkg> to <version>

  .

Major updates (

--major

or High/Critical severity)

• Research breaking changes first (check CHANGELOG, migration guide, release notes).
• Update one dependency at a time.
• Run full test suite after each.
• Individual commits with body noting breaking changes:

  chore(deps): update <pkg> to <version>
  
  Breaking: <brief description of what changed>
  

Decision matrix

--patch

--minor

--major

Step 4: Execute Updates (Update Mode Only)

For each dependency to update, follow this loop strictly:

1. Record current state (version, lock file hash)
2. Update the dependency
3. Run tests: `go test ./...` / `npm test` / `pytest` / `cargo test`
4. If PASS:
   - Stage changed manifest + lock file
   - Commit: chore(deps): update <pkg> from <old> to <new>
5. If FAIL:
   - Revert: restore manifest + lock file to pre-update state
   - Document the incompatibility in the report
   - Continue to next dependency

Ecosystem-specific update commands

go get <pkg>@latest

go get <pkg>@v<major>

npm update <pkg>

npm install <pkg>@latest

pip install --upgrade <pkg>

pip install <pkg>~=<version>

cargo update -p <pkg>

Cargo.toml

cargo update

bundle update <pkg>

Gemfile

bundle install

Step 5: Output Report

Write the report to

.agents/deps/

mkdir -p .agents/deps

File name format:

YYYY-MM-DD-deps-<mode>.md

Report template

# Dependency Report - <mode> - <date>

## Ecosystem: <detected>

## Summary
- Total dependencies: <N>
- Outdated: <N>
- Vulnerable: <N>
- License issues: <N>

## Findings

### Critical
<table or "None">

### High
<table or "None">

### Medium
<table or "None">

### Low
<table or "None">

## Updates Applied
<list of commits or "Audit only - no updates applied">

## Failed Updates
<list with reasons or "None">

## License Compliance
<summary or "Not checked - use $deps license">

License Compliance (License Mode)

Compatibility Matrix

Rules

1. Flag all copyleft licenses (GPL, AGPL, SSPL) as Critical in proprietary projects.
2. Flag weak copyleft (MPL, LGPL) as Medium -- review usage pattern.
3. Flag missing licenses as High -- unknown license is treated as all-rights-reserved.
4. Flag license changes between versions -- an update may change the license.

Detecting project type

• If

  LICENSE

  contains GPL/AGPL: project is copyleft, all licenses are compatible.
• If

  LICENSE

  contains MIT/Apache/BSD or is proprietary: flag copyleft dependencies.
• If no

  LICENSE

  file exists: warn that project license is undefined.

Error Handling

govulncheck

pip-audit

See Also

• skills/standards/SKILL.md

  -- Language-specific conventions

• skills/security/SKILL.md

  -- Broader security scanning

• skills/vibe/SKILL.md

  -- Code quality validation