dependency-management

Dependency Management Workflow

Project: trusted-ai-development-workbench Workflow: Dependency Management Purpose: Monitor, update, and secure project dependencies

Output Formatting Requirements

IMPORTANT: Use actual Unicode emojis in reports, NOT GitHub-style shortcodes.

---

Workflow Overview

┌─────────────────────────────────────────────────────────────────────────────┐
│  DEPENDENCY MANAGEMENT                                                      │
│                                                                             │
│  Step 1: Scan current dependencies                                         │
│  Step 2: Categorize by priority                                            │
│  Step 3: /senior-engineer → Impact analysis (if outdated)                  │
│  Step 4: /security-specialist → Vulnerability assessment (if vulns)        │
│  Step 5: Generate update plan                                              │
│  Step 6: Create work items                                                 │
│  Step 7: Generate health report                                            │
│                                                                             │
│  Each agent command spawns a FRESH CONTEXT WINDOW via Task tool            │
└─────────────────────────────────────────────────────────────────────────────┘

---

Step 1: Scan Current Dependencies

Python Project:

# List current dependencies
pip list --format=json > .claude/temp/current-deps.json

# Check for outdated packages
pip list --outdated --format=json > .claude/temp/outdated-deps.json

# Security audit (requires pip-audit)
pip-audit --format=json > .claude/temp/security-audit.json 2>&1 || true

---

Step 2: Categorize Dependencies

# Parse scan results
import json
from pathlib import Path

# Load results
outdated = json.loads(Path(".claude/temp/outdated-deps.json").read_text())
security = json.loads(Path(".claude/temp/security-audit.json").read_text())

# Categorize
critical_security = []  # CVE Critical
high_priority = []      # CVE High or EOL
medium_priority = []    # Minor updates
low_priority = []       # Patch updates

for vuln in security.get('vulnerabilities', []):
    severity = vuln.get('severity', 'unknown')
    if severity == 'critical':
        critical_security.append(vuln)
    elif severity == 'high':
        high_priority.append(vuln)
    else:
        medium_priority.append(vuln)

print(f"📦 Dependency Scan Results:")
print(f"  🔴 Critical: {len(critical_security)}")
print(f"  🟠 High: {len(high_priority)}")
print(f"  🟡 Medium: {len(medium_priority)}")
print(f"  🟢 Low: {len(low_priority)}")