softaworks/agent-toolkit/dependency-updater

update my dependencies

User Request
    │
    ▼
┌─────────────────────────────────────────────────────┐
│ Step 1: DETECT PROJECT TYPE                         │
│ • Scan for package files (package.json, go.mod...) │
│ • Identify package manager                          │
├─────────────────────────────────────────────────────┤
│ Step 2: CHECK PREREQUISITES                         │
│ • Verify required tools are installed               │
│ • Suggest installation if missing                   │
├─────────────────────────────────────────────────────┤
│ Step 3: SCAN FOR UPDATES                            │
│ • Run language-specific outdated check              │
│ • Categorize: MAJOR / MINOR / PATCH / Fixed         │
├─────────────────────────────────────────────────────┤
│ Step 4: AUTO-APPLY SAFE UPDATES                     │
│ • Apply MINOR and PATCH automatically               │
│ • Report what was updated                           │
├─────────────────────────────────────────────────────┤
│ Step 5: PROMPT FOR MAJOR UPDATES                    │
│ • AskUserQuestion for each MAJOR update             │
│ • Show current → new version                        │
├─────────────────────────────────────────────────────┤
│ Step 6: APPLY APPROVED MAJORS                       │
│ • Update only approved packages                     │
├─────────────────────────────────────────────────────┤
│ Step 7: FINALIZE                                    │
│ • Run install command                               │
│ • Run security audit                                │
└─────────────────────────────────────────────────────┘

# Check prerequisites
scripts/check-tool.sh taze "npm install -g taze"
 
# Scan for updates
taze
 
# Apply minor/patch
taze minor --write
 
# Apply specific majors
taze major --write --include pkg1,pkg2
 
# Monorepo support
taze -r  # recursive
 
# Security
npm audit
npm audit fix

# Check outdated
pip list --outdated
 
# Update all (careful!)
pip-review --auto
 
# Update specific
pip install --upgrade package-name
 
# Security
pip-audit
safety check

# Check outdated
go list -m -u all
 
# Update all
go get -u ./...
 
# Tidy up
go mod tidy
 
# Security
govulncheck ./...

# Check outdated
cargo outdated
 
# Update within semver
cargo update
 
# Security
cargo audit

# Check outdated
bundle outdated
 
# Update all
bundle update
 
# Update specific
bundle update --conservative gem-name
 
# Security
bundle audit

# Check outdated
mvn versions:display-dependency-updates
 
# Update to latest
mvn versions:use-latest-releases
 
# Security
mvn dependency:tree
mvn dependency-check:check

# Check outdated
dotnet list package --outdated
 
# Update specific
dotnet add package PackageName
 
# Security
dotnet list package --vulnerable

# Node.js - Nuclear reset
rm -rf node_modules package-lock.json
npm cache clean --force
npm install
 
# Python - Clean virtualenv
rm -rf venv
python -m venv venv
source venv/bin/activate
pip install -r requirements.txt
 
# Go - Reset modules
rm go.sum
go mod tidy

# Node.js
npm audit
npm audit --json | jq '.metadata.vulnerabilities'
 
# Python
pip-audit
safety check
 
# Go
govulncheck ./...
 
# Rust
cargo audit
 
# Ruby
bundle audit
 
# .NET
dotnet list package --vulnerable

# Install taze globally (recommended)
npm install -g taze
 
# Or use npx
npx taze

# 1. Scan all updates
taze
 
# 2. Apply safe updates (minor + patch)
taze minor --write
 
# 3. For each major, prompt user:
#    "Update @types/node from ^20.0.0 to ^22.0.0?"
#    If yes, add to approved list
 
# 4. Apply approved majors
taze major --write --include approved-pkg1,approved-pkg2
 
# 5. Install
npm install  # or pnpm install / yarn

MAJOR.MINOR.PATCH (e.g., 2.3.1)
 
MAJOR: Breaking changes - requires code changes
MINOR: New features - backward compatible
PATCH: Bug fixes - backward compatible

{
  "dependencies": {
    "critical-lib": "1.2.3",      // Exact for critical
    "stable-lib": "~1.2.3",       // Patch only for stable
    "modern-lib": "^1.2.3"        // Minor OK for active
  }
}

npm ls package-name      # See dependency tree
npm explain package-name # Why installed
yarn why package-name    # Yarn equivalent

// package.json
{
  "overrides": {
    "lodash": "^4.18.0"
  }
}

{
  "resolutions": {
    "lodash": "^4.18.0"
  }
}

pip check
pipdeptree -p package-name

# Use virtual environment
python -m venv venv
source venv/bin/activate
pip install -r requirements.txt
 
# Or use constraints
pip install -c constraints.txt -r requirements.txt