dependency-conflict-resolver

<quick_start> Pre-installation check workflow:

1. Detect package manager: Identify ecosystem from lockfiles (package-lock.json, requirements.txt, Cargo.lock, composer.lock)
2. Scan for conflicts: Check peer dependencies, version ranges, transitive dependencies
3. Security audit: Run ecosystem-specific audit tools (npm audit, pip-audit, cargo-audit, composer audit)
4. Analyze severity: Classify conflicts by risk level (safe auto-fix, manual review, blocking)
5. Present resolution: Auto-apply safe fixes, suggest alternatives for breaking changes, block critical vulnerabilities with alternatives

<trigger_detection> Auto-invoke when detecting these commands:

• npm install, npm i, yarn add, pnpm add
• pip install, poetry add
• cargo add, cargo install
• composer require, composer install </trigger_detection>

<quick_example>

# User attempts: npm install [email protected]
# Skill detects: Peer dependency conflict with [email protected]

[CONFLICT DETECTED]
Package: [email protected]
Conflict: [email protected] requires react ^17.0.0
Risk: MEDIUM (breaking change)

[RECOMMENDED ACTION]
Option 1: Upgrade react-dom to ^18.0.0 (recommended)
  npm install [email protected] [email protected]

Option 2: Downgrade react to ^17.0.0
  npm install [email protected]

[SECURITY CHECK]
✓ No known vulnerabilities in [email protected]
✓ No known vulnerabilities in [email protected]

</quick_example> </quick_start>

Scan current directory for lockfiles and package manifests:

• JavaScript: package.json + (package-lock.json | yarn.lock | pnpm-lock.yaml)
• Python: requirements.txt | Pipfile | pyproject.toml + (Pipfile.lock | poetry.lock)
• Rust: Cargo.toml + Cargo.lock
• PHP: composer.json + composer.lock

Extract:

• Current dependency versions (from lockfile)
• Requested package and version (from user command)
• Version constraints (from manifest) </detection_phase>

<conflict_analysis> 2. Analyze Dependency Conflicts

Check for conflicts in order of severity:

A. Peer Dependency Conflicts

• Compare requested version against peer dependency requirements
• Identify which packages will be incompatible
• Calculate semver compatibility ranges

B. Transitive Dependency Conflicts

• Build dependency graph of all transitive dependencies
• Detect duplicate packages with incompatible versions
• Identify shared dependencies requiring specific versions

C. Version Constraint Violations

• Validate against existing version constraints in manifest
• Check for semver range compatibility (^, ~, >=, etc.)
• Detect locked versions that prevent resolution

D. Platform/Runtime Conflicts

• Check Node.js, Python, PHP version requirements
• Validate feature flags (Rust features)
• Check platform-specific dependencies </conflict_analysis>

<security_audit> 3. Security Vulnerability Scan

Run ecosystem-specific security audits:

JavaScript (npm/yarn/pnpm):

npm audit --json
# Parse output for HIGH/CRITICAL vulnerabilities
# Check: GHSA IDs, CVE numbers, severity scores

Python (pip/poetry):

pip-audit --format json
# Or: poetry audit --json
# Parse PyPA Advisory Database results

Rust (cargo):

cargo audit --json
# Check RustSec Advisory Database
# Identify RUSTSEC-YYYY-NNNN advisories

PHP (composer):

composer audit --format json
# Parse security advisories
# Check for blocked insecure packages

For each vulnerability found:

• Extract severity (LOW, MODERATE, HIGH, CRITICAL)
• Identify patched versions
• Find alternative packages if no patch available
• Assess exploitability and context </security_audit>

<resolution_strategy> 4. Classify Conflicts and Generate Resolutions