Skill

Dependency Updater

softaworks

Security

Works over a project's dependency manifest - detecting the language, applying the safe minor and patch bumps on its own, pausing on major versions, and running that ecosystem's vulnerability audit (npm audit, pip-audit, govulncheck, cargo audit and the like) to flag known-vulnerable packages. It secures the supply chain around your code, not the code itself: it does not scan your own source for bugs, write detection rules, or reason about a design's threats.

Situations it fits

A beloved open-source gadget is stuck on an ancient Rails release. The maintainer wants to float through incremental updates and sniff for tainted third-party libraries before the morning build kicks off.

Dependency Updater. This skill specializes in lazily massaging a repository's dependency graph - automatically elevating low-risk point improvements, parking large jumps, then querying the ecosystem's own defect registry for poisoned artifacts. It wins because the scenario is purely about keeping third-party libraries healthy before a build, not about hunting source-code bugs, writing detection rules, or surfacing failures correctly.

Your frontend build has devolved into dependency Tetris: a released npm library nests four layers of transitive dependencies so deep you need a flashlight. A recent advisory screams that the core parser inside is flagged as rotten, and you want to quietly advance only compatible leaf nodes, freeze anything that would shift the API surface, and cross-check the lock file against the registry before the next deploy.

Dependency Updater. dependency-updater-softaworks specializes in driving upgrades inside a language ecosystem: it parses the dependency manifest, applies conservative automatic bumps to patched sub-versions, stalls on disruptive major releases, and then invokes the project's native security scan to confirm no known-bad packages remain locked in. The tempting distractor semgrep-rule-creator-trailofbits looks related because it too handles vulnerability detection, yet its trap is that it only manufactures custom static-analysis rules for source-code patterns and never touches dependency manifests, skips major bumps, or executes ecosystem audits - it is a rule writer, not a package steward.

3 scenarios in the bank answer to Dependency Updater. The rest are in the game.

Skills it gets confused with

These share a family with Dependency Updater, which is another way of saying they are the ones you might reach for by mistake.

Every comparison with Dependency Updater

Knowing what Dependency Updater does is the easy half. Telling it apart from the others under time pressure is the game.

Today's session

Dependency Updater is part of softaworks/agent-toolkit. Licence: MIT. The description above was written for this game, not taken from the skill.