js-deps

JS Deps

Arguments

Specific package names (e.g. jest @types/jest), . for all packages, or glob patterns (e.g. @testing-library/*).

If $ARGUMENTS is help, --help, -h, or ?, skip the workflow and read references/interactive-help.md.

Workflow Selection

Based on user request:

• Security audit (audit, CVE, vulnerabilities, security): Read references/audit-workflow.md
• Dependency updates (update, upgrade, latest, modernize): Read references/update-workflow.md
• Ambiguous (no clear intent, or invoked with no args and no context): Read references/interactive-help.md to present the interactive help flow.

If the user expresses version preferences (e.g., "only minor and patch", "skip major versions", "only critical CVEs"), apply the filters defined in references/interactive-help.md without requiring an explicit --help invocation.

Shared Process

1. Create Worktree

Create an isolated git worktree so the main working directory is never modified:

TIMESTAMP=$(date +%Y%m%d-%H%M%S)
BRANCH_NAME="js-deps-$TIMESTAMP"
# Prefer a sibling directory to the project root; fall back to $TMPDIR if that's not writable
WORKTREE_PATH="$(dirname "$(git rev-parse --show-toplevel)")/$BRANCH_NAME"
git worktree add "$WORKTREE_PATH" -b "$BRANCH_NAME" 2>/dev/null || {
  WORKTREE_PATH="${TMPDIR:-/private/tmp}/$BRANCH_NAME"
  git worktree add "$WORKTREE_PATH" -b "$BRANCH_NAME"
}

If both locations fail, the environment likely restricts all writes outside the project. In that case:

Grant write access to either the project's parent directory or $TMPDIR in your assistant's settings (in Claude Code: add the relevant path to your sandbox allowlist in settings.json) and retry.

All subsequent steps operate within $WORKTREE_PATH. Discovery, installs, edits, and commits all happen there. Paths like cd <directory> in reference files are relative to $WORKTREE_PATH.