dependency-update-bot

Name: dependency-update-bot
Author: Varnan-Tech

21installs59forks

How to install dependency-update-bot?

varnan-tech/opendirectory/dependency-update-bot

$npx -y skills add Varnan-Tech/opendirectory --skill dependency-update-bot

Installs into the current project.

Summary

Scans your project for outdated npm, pip, Cargo, Go, or Ruby packages. Runs a CVE security audit. Fetches changelogs, summarizes breaking changes with Gemini, and opens one PR per risk group (patch, minor, major). Includes Diagnosis Mode for install conflicts. Use when asked to u

Files · 1

View on GitHub

SKILL.md

1	# Dependency Update Bot
2
3	Scan for outdated packages. Run a security audit. Fetch changelogs. Summarize breaking changes. Open one PR per risk group.
4
5	---
6
7	Critical rule: Only update packages that the package manager's outdated command actually reports. Never guess or invent version numbers. If a changelog cannot be fetched, note the gap rather than inventing content.
8
9	---
10
11	## Step 1: Setup Check
12
13	```bash
14	echo "GEMINI_API_KEY: ${GEMINI_API_KEY:+set}"
15	echo "GITHUB_TOKEN: ${GITHUB_TOKEN:-not set, changelog fetching rate-limited to 60/hour}"
16	gh auth status 2>/dev/null \| head -1 \|\| echo "gh: not authenticated"
17	```
18
19	If GEMINI_API_KEY is missing: Stop. Tell the user: "GEMINI_API_KEY is required. Get it at aistudio.google.com. Add it to your .env file."
20
21	If gh is not authenticated: Stop. Tell the user: "GitHub CLI must be authenticated. Run: gh auth login"
22
23	Detect package manager(s):
24
25	```bash
26	ls package.json 2>/dev/null && echo "npm"
27	ls requirements.txt pyproject.toml 2>/dev/null && echo "pip"
28	ls Cargo.toml 2>/dev/null && echo "cargo"
29	ls go.mod 2>/dev/null && echo "go"
30	ls Gemfile 2>/dev/null && echo "ruby"
31	```
32
33	If multiple are found, ask: "Found [list]. Which should I scan? (all / npm / pip / cargo / go / ruby)"
34
35	---
36
37	## Step 2: Detect Outdated Packages
38
39	npm:
40	```bash
41	npm outdated --json --long 2>/dev/null \| python3 -c "
42	import sys, json
43	data = json.load(sys.stdin)
44	for name, info in data.items():
45	print(json.dumps({'name': name, 'current': info.get('current','?'), 'latest': info.get('latest','?'), 'dep_type': info.get('type','dependencies')}))
46	"
47	```
48
49	pip:
50	```bash
51	pip list --outdated --format=json 2>/dev/null \| python3 -c "
52	import sys, json
53	for p in json.load(sys.stdin):
54	print(json.dumps({'name': p['name'], 'current': p['version'], 'latest': p['latest_version']}))
55	"
56	```
57
58	Cargo (Rust):
59	```bash
60	cargo outdated --format json 2>/dev/null \|\| \
61	cargo outdated 2>/dev/null \| grep -v "^---" \| tail -n +3 \| head -30
62	# If cargo-outdated not installed: cargo install cargo-outdated
63	```
64
65	Go modules:
66	```bash
67	go list -u -m -json all 2>/dev/null \| python3 -c "
68	import sys, json
69	decoder = json.JSONDecoder()
70	buf = sys.stdin.read()
71	pos = 0
72	while pos < len(buf):
73	try:
74	obj, idx = decoder.raw_decode(buf, pos)
75	if obj.get('Update'):
76	print(json.dumps({'name': obj['Path'], 'current': obj['Version'], 'latest': obj['Update']['Version']}))
77	pos += idx
78	except: break
79	"
80	```
81
82	Ruby (Bundler):
83	```bash
84	bundle outdated --parseable 2>/dev/null \| python3 -c "
85	import sys
86	for line in sys.stdin:
87	parts = line.strip().split()
88	if len(parts) >= 4:
89	print('{\"name\":\"' + parts[0] + '\",\"current\":\"' + parts[3].strip('()') + '\",\"latest\":\"' + parts[1] + '\"}')
90	"
91	```
92
93	If all return empty: "All packages are up to date." Stop.
94
95	State count before proceeding: "Found X outdated packages."
96
97	---
98
99	## Step 3: Classify by Risk Level
100
101	Parse version bump (current → latest):
102	- MAJOR: first digit changed (1.x.x → 2.x.x)
103	- MINOR: second digit changed (1.2.x → 1.3.x)
104	- PATCH: third digit changed (1.2.3 → 1.2.4)
105
106	```bash
107	python3 -c "
108	def classify(current, latest):
109	try:
110	c = [int(x) for x in current.lstrip('v').split('.')[:3]]
111	l = [int(x) for x in latest.lstrip('v').split('.')[:3]]
112	if l[0] > c[0]: return 'major'
113	if len(l) > 1 and len(c) > 1 and l[1] > c[1]: return 'minor'
114	return 'patch'
115	except: return 'unknown'
116	"
117	```
118
119	State the breakdown: "Patch: X packages. Minor: Y packages. Major: Z packages."
120
121	---
122
123	## Step 4: Security Audit
124
125	Run a CVE scan before creating any PRs. This determines urgency.
126
127	npm:
128	```bash
129	npm audit --json 2>/dev/null \| python3 -c "
130	import sys, json
131	d = json.load(sys.stdin)
132	vulns = d.get('vulnerabilities', {})
133	for pkg, info in vulns.items():
134	sev = info.get('severity', 'unknown')
135	via = [v.get('title','') for v in info.get('via',[]) if isinstance(v, dict)]
136	print(f' [{sev.upper()}] {pkg}: {via[0] if via else \"see npm audit\"}')
137	" 2>/dev/null \|\| echo "No vulnerabilities found or npm audit not available"
138	```
139
140	pip:
141	```bash
142	pip-audit --format=json 2>/dev/null \| python3 -c "
143	import sys, json
144	for vuln in json.load(sys.stdin):
145	print(f' [{vuln.get(\"aliases\",[\"\"])[0]}]

People who liked this also viewed

6 picks

Type

dependency-update-bot

21installs59forks

View on GitHub

How to install dependency-update-bot?

varnan-tech/opendirectory/dependency-update-bot

$npx -y skills add Varnan-Tech/opendirectory --skill dependency-update-bot

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Dependency Update Bot
2
3	Scan for outdated packages. Run a security audit. Fetch changelogs. Summarize breaking changes. Open one PR per risk group.
4
5	---
6
7	Critical rule: Only update packages that the package manager's outdated command actually reports. Never guess or invent version numbers. If a changelog cannot be fetched, note the gap rather than inventing content.
8
9	---
10
11	## Step 1: Setup Check
12
13	```bash
14	echo "GEMINI_API_KEY: ${GEMINI_API_KEY:+set}"
15	echo "GITHUB_TOKEN: ${GITHUB_TOKEN:-not set, changelog fetching rate-limited to 60/hour}"
16	gh auth status 2>/dev/null \| head -1 \|\| echo "gh: not authenticated"
17	```
18
19	If GEMINI_API_KEY is missing: Stop. Tell the user: "GEMINI_API_KEY is required. Get it at aistudio.google.com. Add it to your .env file."
20
21	If gh is not authenticated: Stop. Tell the user: "GitHub CLI must be authenticated. Run: gh auth login"
22
23	Detect package manager(s):
24
25	```bash
26	ls package.json 2>/dev/null && echo "npm"
27	ls requirements.txt pyproject.toml 2>/dev/null && echo "pip"
28	ls Cargo.toml 2>/dev/null && echo "cargo"
29	ls go.mod 2>/dev/null && echo "go"
30	ls Gemfile 2>/dev/null && echo "ruby"
31	```
32
33	If multiple are found, ask: "Found [list]. Which should I scan? (all / npm / pip / cargo / go / ruby)"
34
35	---
36
37	## Step 2: Detect Outdated Packages
38
39	npm:
40	```bash
41	npm outdated --json --long 2>/dev/null \| python3 -c "
42	import sys, json
43	data = json.load(sys.stdin)
44	for name, info in data.items():
45	print(json.dumps({'name': name, 'current': info.get('current','?'), 'latest': info.get('latest','?'), 'dep_type': info.get('type','dependencies')}))
46	"
47	```
48
49	pip:
50	```bash
51	pip list --outdated --format=json 2>/dev/null \| python3 -c "
52	import sys, json
53	for p in json.load(sys.stdin):
54	print(json.dumps({'name': p['name'], 'current': p['version'], 'latest': p['latest_version']}))
55	"
56	```
57
58	Cargo (Rust):
59	```bash
60	cargo outdated --format json 2>/dev/null \|\| \
61	cargo outdated 2>/dev/null \| grep -v "^---" \| tail -n +3 \| head -30
62	# If cargo-outdated not installed: cargo install cargo-outdated
63	```
64
65	Go modules:
66	```bash
67	go list -u -m -json all 2>/dev/null \| python3 -c "
68	import sys, json
69	decoder = json.JSONDecoder()
70	buf = sys.stdin.read()
71	pos = 0
72	while pos < len(buf):
73	try:
74	obj, idx = decoder.raw_decode(buf, pos)
75	if obj.get('Update'):
76	print(json.dumps({'name': obj['Path'], 'current': obj['Version'], 'latest': obj['Update']['Version']}))
77	pos += idx
78	except: break
79	"
80	```
81
82	Ruby (Bundler):
83	```bash
84	bundle outdated --parseable 2>/dev/null \| python3 -c "
85	import sys
86	for line in sys.stdin:
87	parts = line.strip().split()
88	if len(parts) >= 4:
89	print('{\"name\":\"' + parts[0] + '\",\"current\":\"' + parts[3].strip('()') + '\",\"latest\":\"' + parts[1] + '\"}')
90	"
91	```
92
93	If all return empty: "All packages are up to date." Stop.
94
95	State count before proceeding: "Found X outdated packages."
96
97	---
98
99	## Step 3: Classify by Risk Level
100
101	Parse version bump (current → latest):
102	- MAJOR: first digit changed (1.x.x → 2.x.x)
103	- MINOR: second digit changed (1.2.x → 1.3.x)
104	- PATCH: third digit changed (1.2.3 → 1.2.4)
105
106	```bash
107	python3 -c "
108	def classify(current, latest):
109	try:
110	c = [int(x) for x in current.lstrip('v').split('.')[:3]]
111	l = [int(x) for x in latest.lstrip('v').split('.')[:3]]
112	if l[0] > c[0]: return 'major'
113	if len(l) > 1 and len(c) > 1 and l[1] > c[1]: return 'minor'
114	return 'patch'
115	except: return 'unknown'
116	"
117	```
118
119	State the breakdown: "Patch: X packages. Minor: Y packages. Major: Z packages."
120
121	---
122
123	## Step 4: Security Audit
124
125	Run a CVE scan before creating any PRs. This determines urgency.
126
127	npm:
128	```bash
129	npm audit --json 2>/dev/null \| python3 -c "
130	import sys, json
131	d = json.load(sys.stdin)
132	vulns = d.get('vulnerabilities', {})
133	for pkg, info in vulns.items():
134	sev = info.get('severity', 'unknown')
135	via = [v.get('title','') for v in info.get('via',[]) if isinstance(v, dict)]
136	print(f' [{sev.upper()}] {pkg}: {via[0] if via else \"see npm audit\"}')
137	" 2>/dev/null \|\| echo "No vulnerabilities found or npm audit not available"
138	```
139
140	pip:
141	```bash
142	pip-audit --format=json 2>/dev/null \| python3 -c "
143	import sys, json
144	for vuln in json.load(sys.stdin):
145	print(f' [{vuln.get(\"aliases\",[\"\"])[0]}]

People who liked this also viewed

6 picks

Type