Dependency Updater Smart dependency management for any language with automatic detection and safe updates. Quick Start update my dependencies The skill auto-detects your project type and handles the rest. Triggers Trigger Example Update dependencies "update dependencies", "update deps" Check outdated "check for outdated packages" Fix dependency issues "fix my dependency problems" Security audit "audit dependencies for vulnerabilities" Diagnose deps "diagnose dependency issues" Supported Languages Language Package File Update Tool Audit Tool Node.js package.json taze npm audit Python requirements.txt, pyproject.toml pip-review safety , pip-audit Go go.mod go get -u govulncheck Rust Cargo.toml cargo update cargo audit Ruby Gemfile bundle update bundle audit Java pom.xml, build.gradle mvn versions: mvn dependency: .NET *.csproj dotnet outdated dotnet list package --vulnerable Quick Reference Update Type Version Change Action Fixed No ^ or ~ Skip (intentionally pinned) PATCH x.y.z → x.y.Z Auto-apply MINOR x.y.z → x.Y.0 Auto-apply MAJOR x.y.z → X.0.0 Prompt user individually Workflow User Request │ ▼ ┌─────────────────────────────────────────────────────┐ │ Step 1: DETECT PROJECT TYPE │ │ • Scan for package files (package.json, go.mod...) │ │ • Identify package manager │ ├─────────────────────────────────────────────────────┤ │ Step 2: CHECK PREREQUISITES │ │ • Verify required tools are installed │ │ • Suggest installation if missing │ ├─────────────────────────────────────────────────────┤ │ Step 3: SCAN FOR UPDATES │ │ • Run language-specific outdated check │ │ • Categorize: MAJOR / MINOR / PATCH / Fixed │ ├─────────────────────────────────────────────────────┤ │ Step 4: AUTO-APPLY SAFE UPDATES │ │ • Apply MINOR and PATCH automatically │ │ • Report what was updated │ ├─────────────────────────────────────────────────────┤ │ Step 5: PROMPT FOR MAJOR UPDATES │ │ • AskUserQuestion for each MAJOR update │ │ • Show current → new version │ ├─────────────────────────────────────────────────────┤ │ Step 6: APPLY APPROVED MAJORS │ │ • Update only approved packages │ ├─────────────────────────────────────────────────────┤ │ Step 7: FINALIZE │ │ • Run install command │ │ • Run security audit │ └─────────────────────────────────────────────────────┘ Commands by Language Node.js (npm/yarn/pnpm)

Check prerequisites

scripts/check-tool.sh taze "npm install -g taze"

Scan for updates

taze

Apply minor/patch

taze minor --write

Apply specific majors

taze major --write --include pkg1,pkg2

Monorepo support

taze -r

recursive

Security

npm audit npm audit fix Python

Check outdated

pip list --outdated

Update all (careful!)

pip-review --auto

Update specific

pip install --upgrade package-name

Security

pip-audit safety check Go

Check outdated

go list -m -u all

Update all

go get -u ./ .. .

Tidy up

go mod tidy

Security

govulncheck ./ .. . Rust

Check outdated

cargo outdated

Update within semver

cargo update

Security

cargo audit Ruby

Check outdated

bundle outdated

Update all

bundle update

Update specific

bundle update --conservative gem-name

Security

bundle audit Java (Maven)

Check outdated

mvn versions:display-dependency-updates

Update to latest

mvn versions:use-latest-releases

Security

mvn dependency:tree mvn dependency-check:check .NET

Check outdated

dotnet list package --outdated

Update specific

dotnet add package PackageName

Security

dotnet list package --vulnerable Diagnosis Mode When dependencies are broken, run diagnosis: Common Issues & Fixes Issue Symptoms Fix Version Conflict "Cannot resolve dependency tree" Clean install, use overrides/resolutions Peer Dependency "Peer dependency not satisfied" Install required peer version Security Vuln npm audit shows issues npm audit fix or manual update Unused Deps Bloated bundle Run depcheck (Node) or equivalent Duplicate Deps Multiple versions installed Run npm dedupe or equivalent Emergency Fixes

Node.js - Nuclear reset

rm -rf node_modules package-lock.json npm cache clean --force npm install

Python - Clean virtualenv

rm -rf venv python -m venv venv source venv/bin/activate pip install -r requirements.txt

Go - Reset modules

rm go.sum go mod tidy Security Audit Run security checks for any project:

Node.js

npm audit npm audit --json | jq '.metadata.vulnerabilities'

Python

pip-audit safety check

Go

govulncheck ./ .. .

Rust

cargo audit

Ruby

bundle audit

.NET

dotnet list package --vulnerable Severity Response Severity Action Critical Fix immediately High Fix within 24h Moderate Fix within 1 week Low Fix in next release Anti-Patterns Avoid Why Instead Update fixed versions Intentionally pinned Skip them Auto-apply MAJOR Breaking changes Prompt user Batch MAJOR prompts Loses context Prompt individually Skip lock file Irreproducible builds Always commit lock files Ignore security alerts Vulnerabilities Address by severity Verification Checklist After updates: Updates scanned without errors MINOR/PATCH auto-applied MAJOR updates prompted individually Fixed versions untouched Lock file updated Install command ran Security audit passed (or issues noted) The skill auto-detects project type by scanning for package files: File Found Language Package Manager package.json Node.js npm/yarn/pnpm requirements.txt Python pip pyproject.toml Python pip/poetry Pipfile Python pipenv go.mod Go go modules Cargo.toml Rust cargo Gemfile Ruby bundler pom.xml Java Maven build.gradle Java/Kotlin Gradle *.csproj .NET dotnet Detection order matters for monorepos: Check current directory first Then check for workspace/monorepo patterns Offer to run recursively if applicable Prerequisites

Install taze globally (recommended)

npm install -g taze

Or use npx

npx taze Smart Update Flow

1. Scan all updates

taze

2. Apply safe updates (minor + patch)

taze minor --write

3. For each major, prompt user:

"Update @types/node from ^20.0.0 to ^22.0.0?"

If yes, add to approved list

4. Apply approved majors

taze major --write --include approved-pkg1,approved-pkg2

5. Install

npm install

or pnpm install / yarn

Auto-Approve List Some packages have frequent major bumps but are backward-compatible: Package Reason lucide-react Icon library, majors are additive @types/* Type definitions, usually safe Semantic Versioning MAJOR.MINOR.PATCH (e.g., 2.3.1) MAJOR: Breaking changes - requires code changes MINOR: New features - backward compatible PATCH: Bug fixes - backward compatible Range Specifiers Specifier Meaning Example ^1.2.3 Minor + Patch OK

=1.2.3 <2.0.0 ~1.2.3 Patch only =1.2.3 <1.3.0 1.2.3 Exact (fixed) Only 1.2.3 =1.2.3 At least Any =1.2.3 * Any Latest (dangerous) Recommended Strategy { "dependencies" : { "critical-lib" : "1.2.3" , // Exact for critical "stable-lib" : "~1.2.3" , // Patch only for stable "modern-lib" : "^1.2.3" // Minor OK for active } } Node.js Conflicts Diagnosis: npm ls package-name

See dependency tree

npm explain package-name

Why installed

yarn why package-name

Yarn equivalent

Resolution with overrides: // package.json { "overrides" : { "lodash" : "^4.18.0" } } Resolution with resolutions (Yarn): { "resolutions" : { "lodash" : "^4.18.0" } } Python Conflicts Diagnosis: pip check pipdeptree -p package-name Resolution:

Use virtual environment

python -m venv venv source venv/bin/activate pip install -r requirements.txt

Or use constraints

pip install -c constraints.txt -r requirements.txt Script Reference Script Purpose scripts/check-tool.sh Verify tool is installed scripts/run-taze.sh Run taze with proper flags Related Tools Tool Language Purpose taze Node.js Smart dependency updates npm-check-updates Node.js Alternative to taze pip-review Python Interactive pip updates cargo-edit Rust Cargo dependency management bundler-audit Ruby Security auditing