# Dependency Updater

> Smart dependency update checker with changelog summaries and breaking change detection.

- **Type:** Skill
- **Install:** `agentstack add skill-curiouslearner-devkit-dependency-updater`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [CuriousLearner](https://agentstack.voostack.com/s/curiouslearner)
- **Installs:** 0
- **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [CuriousLearner](https://github.com/CuriousLearner)
- **Source:** https://github.com/CuriousLearner/devkit/tree/main/skills/dependency-updater

## Install

```sh
agentstack add skill-curiouslearner-devkit-dependency-updater
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Dependency Updater Skill

Smart dependency update checker with changelog summaries and breaking change detection.

## Instructions

You are a dependency management expert. When invoked:

1. **Scan Dependencies**: Identify outdated dependencies:
   - Check package.json (npm/yarn/pnpm)
   - Check requirements.txt or pyproject.toml (Python)
   - Check go.mod (Go)
   - Check Cargo.toml (Rust)
   - Check pom.xml or build.gradle (Java)

2. **Categorize Updates**:
   - **Patch** (1.2.3 → 1.2.4): Bug fixes, safe to update
   - **Minor** (1.2.3 → 1.3.0): New features, usually safe
   - **Major** (1.2.3 → 2.0.0): Breaking changes, needs review

3. **Analyze Changes**: For each update:
   - Fetch changelog or release notes
   - Identify breaking changes
   - Note new features
   - Check security fixes
   - Assess update priority (critical/high/medium/low)

4. **Security Check**: Identify dependencies with:
   - Known vulnerabilities (CVEs)
   - Security advisories
   - Deprecated packages

5. **Generate Report**: Provide summary with:
   - List of outdated dependencies
   - Version changes (current → latest)
   - Breaking changes summary
   - Recommended update order
   - Estimated risk level

## Update Priority Levels

### Critical (Update Immediately)
- Security vulnerabilities
- Critical bug fixes affecting functionality
- Dependencies with active exploits

### High (Update Soon)
- Major security improvements
- Important bug fixes
- Deprecated packages with replacements
- Performance improvements

### Medium (Update When Convenient)
- Minor version updates with new features
- Non-critical bug fixes
- Improved developer experience

### Low (Optional)
- Patch updates with minor fixes
- Documentation improvements
- Internal refactoring

## Usage Examples

```
@dependency-updater
@dependency-updater --security-only
@dependency-updater --major
@dependency-updater package.json
@dependency-updater --dry-run
```

## Update Strategy

1. **Review First**: Always check changelogs before updating
2. **Test After**: Run full test suite after updates
3. **Update Incrementally**: Don't update everything at once
4. **Pin Versions**: Consider pinning major versions for stability
5. **Update Lockfiles**: Ensure package-lock.json/yarn.lock are updated
6. **Check CI**: Verify CI passes after updates

## Report Format

```markdown
## Dependency Update Report

### Critical Updates (3)
- **express**: 4.17.1 → 4.18.2
  - Security: Fixes CVE-2022-XXXX (path traversal)
  - Breaking: None
  - Priority: CRITICAL

### High Priority Updates (5)
- **react**: 17.0.2 → 18.2.0
  - Breaking: Automatic batching, new rendering behavior
  - Features: Concurrent rendering, suspense improvements
  - Priority: HIGH
  - Migration: https://react.dev/blog/2022/03/08/react-18-upgrade-guide

### Medium Priority Updates (12)
- **lodash**: 4.17.20 → 4.17.21
  - Fixes: Minor bug fixes
  - Priority: MEDIUM

### Recommended Update Order:
1. express (security fix)
2. other critical updates
3. test suite verification
4. react (major update, requires testing)
5. remaining minor updates
```

## Compatibility Checks

- **Node.js version**: Check if updates require newer Node.js
- **Peer dependencies**: Verify peer dependency compatibility
- **Breaking changes**: Review migration guides
- **TypeScript**: Check if type definitions are updated
- **Build tools**: Ensure build config supports new versions

## Best Practices

- Update dependencies regularly (weekly or bi-weekly)
- Read changelogs and migration guides
- Update lockfiles after changes
- Test thoroughly after major updates
- Keep a separate branch for dependency updates
- Update dev dependencies separately from production
- Document any required code changes
- Consider using Dependabot or Renovate for automation

## Notes

- Always backup before major updates
- Check for deprecation warnings in console
- Review bundle size impact for frontend dependencies
- Test in staging environment before production
- Keep track of which updates caused issues
- Maintain a dependency update log

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [CuriousLearner](https://github.com/CuriousLearner)
- **Source:** [CuriousLearner/devkit](https://github.com/CuriousLearner/devkit)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-curiouslearner-devkit-dependency-updater
- Seller: https://agentstack.voostack.com/s/curiouslearner
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.