# Manage Dependency Updates and Audits

Dependency updates can hide vulnerabilities, license issues, and breaking changes. This skill guides audits, safe upgrades, and reports across common package managers.

## Install

```bash
npx skillstore add joseph obrien/89jobrien-dependency-management
```

## Metadata

- Status: approved
- Slug: 89jobrien-dependency-management
- Version: 1.0.1
- Author version: 1.0.1
- Skillstore revision: r1
- Version status: valid
- Tree hash: 4f82aaa7187a3289fb0e6e50c5b28eeddd3ef583cf0cc869695b608642b7cfbb
- Author: Joseph OBrien
- GitHub username: 89jobrien
- License: MIT
- Repository: https://github.com/89jobrien/steve/tree/main/steve/skills/dependency-management
- Ref: c4037264bbd363c572662d6154a3ab28f5ca4f53
- Supported tools: Claude, Codex, Claude Code
- Audit status: complete
- Agent install advisory: allowed
- Manual install advisory: allowed
- Artifact signature: available
- Audit attestation: unavailable
- Human verification: not\_verified
- Risk factors: external\_commands
- Quality score: 83
- Quality tier: gold
- Public page: https://skillstore.pages.dev/skills/89jobrien-dependency-management
- Manifest: https://skillstore.pages.dev/api/skills/89jobrien-dependency-management/manifest

## Capabilities

- Parses package.json, requirements.txt, and basic pyproject.toml files with an included Python helper.
- Lists command patterns for npm, pip, Poetry, Maven, Gradle, and Cargo.
- Guides vulnerability scans with npm audit, pip-audit, and OWASP Dependency Check.
- Supports license review using dependency lists and audit report templates.
- Provides a report template for vulnerabilities, outdated packages, licenses, and update plans.
- Recommends incremental updates with changelog review and post-update tests.

## Use Cases

- Prioritize security fixes: Review dependency audit results and identify the safest order for urgent package upgrades.
- Plan routine package updates: Compare outdated dependencies, separate patch updates from major upgrades, and define test checkpoints.
- Prepare compliance evidence: Summarize dependency licenses, unknown licenses, and packages that need policy review.

## Prompt Templates

### Scan dependencies

```
Scan this project for dependency issues. Identify package manager files, suggest audit commands, and summarize the highest priority fixes.
```

### Review outdated packages

```
Review outdated dependencies in this project. Group updates by patch, minor, and major risk, then recommend a safe update order.
```

### Check license risk

```
Check dependency licenses for this project. Flag unknown or incompatible licenses and prepare a concise compliance report.
```

### Create upgrade plan

```
Create a staged dependency upgrade plan for this repository. Include vulnerability priority, breaking-change risk, test gates, and rollback notes.
```

## Limitations

- The helper parser supports only package.json, requirements.txt, and basic pyproject.toml formats.
- It does not verify current CVE data unless local audit tools are run.
- Package updates still require project tests and human review before release.
- Legal license compatibility needs project policy and legal review.

## Best Practices

- Run dependency audits before changing versions, then update the highest severity issues first.
- Review changelogs and test after each update group.
- Keep lock files committed so dependency changes stay reproducible.

## Anti Patterns

- Do not apply major updates without reviewing breaking changes.
- Do not ignore unknown licenses in release dependencies.
- Do not run forceful audit fixes without a rollback plan.

## Security Audit

- Audited at: 2026-07-05T11:52:11.598\+00:00
- Summary: All static detections were adjudicated as false positives. The high sensitive finding is license metadata extraction, and the external command findings are Markdown examples or package-manager references. No prompt injection, exfiltration intent, or malicious semantic behavior was found.

## Stats

- Views: 191
- Downloads: 20
- Favorites: 0
- Popularity score: 0