deps-update

Dependency Update Manager

Checks for outdated dependencies, identifies security advisories, checks compatibility, and creates an update plan.

---

Execution Flow

Step 1: Detect Package Manager

[ -f "pnpm-lock.yaml" ] && echo "PNPM"
[ -f "yarn.lock" ] && echo "YARN"
[ -f "bun.lockb" ] && echo "BUN"
[ -f "package-lock.json" ] && echo "NPM"
[ -f "requirements.txt" ] || [ -f "pyproject.toml" ] && echo "PIP"
[ -f "Pipfile" ] && echo "PIPENV"
[ -f "poetry.lock" ] && echo "POETRY"
[ -f "go.sum" ] && echo "GO"
[ -f "Cargo.lock" ] && echo "CARGO"
[ -f "Gemfile.lock" ] && echo "BUNDLER"

---

Step 2: Check Outdated Dependencies

Mode: {{mode}} (default: check)

# Node.js
npm outdated --json 2>/dev/null

# Python
pip list --outdated --format=json 2>/dev/null

# Go
go list -u -m all 2>/dev/null

# Rust
cargo outdated 2>/dev/null

Display as structured table:

Outdated Dependencies
---------------------
Package          Current   Wanted    Latest    Type
react            18.2.0    18.3.1    19.0.0    dependencies
typescript       5.3.3     5.4.5     5.7.2     devDependencies
@types/node      20.10.0   20.14.2   22.10.1   devDependencies
eslint           8.56.0    8.57.1    9.15.0    devDependencies

---

Step 3: Security Advisory Check

# Node.js
npm audit --json 2>/dev/null

# Python
pip-audit --format=json 2>/dev/null

# Go
govulncheck ./... 2>/dev/null

# Rust
cargo audit --json 2>/dev/null

Flag security-critical updates:

Security Advisories
-------------------
CRITICAL:
  [email protected] -> 4.18.2 (CVE-2024-XXXX: Open Redirect)
  [email protected] -> 9.0.0 (CVE-2022-23529: Algorithm Confusion)

HIGH:
  [email protected] -> 1.6.0 (CVE-2023-45857: CSRF Bypass)

---

Step 4: Run by Mode

check (default)

Report only. No changes made. Display outdated deps and advisories.

security

Update only packages with known security vulnerabilities:

# Node.js
npm audit fix

# Python
pip install --upgrade <package-with-advisory>

# Go
go get <module>@latest

# Rust
cargo update <crate>