deps（deps 搜索）

Deps Skill

Quick Ref: /deps audit | /deps update [--major|--minor|--patch] | /deps vuln | /deps license

YOU MUST EXECUTE THIS WORKFLOW. Do not just describe it.

Modes

Default (bare /deps): runs audit mode.

Step 0: Detect Ecosystem

Scan the working directory for manifest files. Multiple ecosystems may coexist.

# Detect all ecosystems present
for f in go.mod package.json pyproject.toml requirements.txt Cargo.toml Gemfile; do
  [[ -f "$f" ]] && echo "FOUND: $f"
done

If no manifest is found, stop and report: "No supported dependency manifest detected."

Step 1: Audit Current State

Run the ecosystem-appropriate commands. Capture all output for classification.

Go

go list -m -u all          # List all modules, flag available updates
govulncheck ./...           # Vulnerability scan against Go vuln DB
go mod tidy                 # Clean up unused deps (dry-run first)

Node

npm audit                   # Known vulnerabilities
npm outdated                # Available updates (current vs wanted vs latest)
npx license-checker-webpack-plugin --out /dev/stdout 2>/dev/null || npx license-checker --json

Python

pip-audit                   # Vulnerability scan (install: pip install pip-audit)
pip list --outdated         # Available updates
pip-licenses 2>/dev/null || echo "pip-licenses not installed"

Rust

cargo audit                 # Vulnerability scan (install: cargo install cargo-audit)
cargo outdated              # Available updates (install: cargo install cargo-outdated)
cargo license 2>/dev/null || echo "cargo-license not installed"

Ruby

bundle audit check          # Vulnerability scan (install: gem install bundler-audit)
bundle outdated             # Available updates

Step 2: Classify Findings

Sort every finding into exactly one severity tier.

Output a summary table:

SEVERITY   PACKAGE            CURRENT   AVAILABLE   REASON
Critical   example-lib        1.2.3     1.2.8       CVE-2025-XXXXX (RCE)
High       some-framework     3.1.0     4.2.0       Security advisory SA-2025-YYY
Medium     helper-pkg         2.0.1     2.3.0       3 minor versions behind
Low        util-lib           1.0.0     1.0.1       Patch release

Step 3: Update Strategy

Choose strategy based on the update scope requested (or default to the classification).

Patch updates (--patch or Low severity)

• Batch all patch updates together.
• Run full test suite once after the batch.
• Single commit: chore(deps): batch patch updates.

Minor updates (--minor or Medium severity)

• Update one dependency at a time.
• Run tests after each update.
• Individual commits: chore(deps): update <pkg> to <version>.

Major updates (--major or High/Critical severity)

• Research breaking changes first (check CHANGELOG, migration guide, release notes).
• Update one dependency at a time.
• Run full test suite after each.
• Individual commits with body noting breaking changes: chore(deps): update <pkg> to <version> Breaking: <brief description of what changed>

Decision matrix

Step 4: Execute Updates (Update Mode Only)

For each dependency to update, follow this loop strictly:

1. Record current state (version, lock file hash)
2. Update the dependency
3. Run tests: `go test ./...` / `npm test` / `pytest` / `cargo test`
4. If PASS:
   - Stage changed manifest + lock file
   - Commit: chore(deps): update <pkg> from <old> to <new>
5. If FAIL:
   - Revert: restore manifest + lock file to pre-update state
   - Document the incompatibility in the report
   - Continue to next dependency

Ecosystem-specific update commands

Step 5: Output Report

Write the report to .agents/deps/. Create the directory if needed.

mkdir -p .agents/deps

File name format: YYYY-MM-DD-deps-<mode>.md

Report template

# Dependency Report - <mode> - <date>

## Ecosystem: <detected>

## Summary
- Total dependencies: <N>
- Outdated: <N>
- Vulnerable: <N>
- License issues: <N>

## Findings

### Critical
<table or "None">

### High
<table or "None">

### Medium
<table or "None">

### Low
<table or "None">

## Updates Applied
<list of commits or "Audit only - no updates applied">

## Failed Updates
<list with reasons or "None">

## License Compliance
<summary or "Not checked - use /deps license">

License Compliance (License Mode)

Compatibility Matrix

Rules

1. Flag all copyleft licenses (GPL, AGPL, SSPL) as Critical in proprietary projects.
2. Flag weak copyleft (MPL, LGPL) as Medium -- review usage pattern.
3. Flag missing licenses as High -- unknown license is treated as all-rights-reserved.
4. Flag license changes between versions -- an update may change the license.

Detecting project type

• If LICENSE contains GPL/AGPL: project is copyleft, all licenses are compatible.
• If LICENSE contains MIT/Apache/BSD or is proprietary: flag copyleft dependencies.
• If no LICENSE file exists: warn that project license is undefined.

Error Handling

See Also

• skills/standards/SKILL.md -- Language-specific conventions
• skills/security/SKILL.md -- Broader security scanning
• skills/vibe/SKILL.md -- Code quality validation