dependency-analyzer
Analyzes project dependencies, detects outdated packages, identifies breaking changes, and suggests safe update strategies. Helps maintain dependency health and security.
When & Why to Use This Skill
The Dependency Analyzer is a specialized Claude skill designed to automate the maintenance and security of software projects. It systematically scans dependency manifests—such as package.json, requirements.txt, and go.mod—to identify outdated packages and security vulnerabilities. By leveraging semantic versioning analysis and real-time web research, it detects potential breaking changes and provides developers with structured, low-risk update strategies and migration guidance to ensure long-term codebase stability.
Use Cases
- Automated Security Audits: Quickly identify high-risk dependencies with known CVEs and receive specific version recommendations to patch vulnerabilities.
- Strategic Version Upgrades: Generate phased update plans that distinguish between safe patch/minor updates and high-risk major version bumps to minimize regression risks.
- Breaking Change Impact Analysis: Research specific breaking changes in major library updates using integrated web search to provide actionable migration steps and code adjustment advice.
- Project Health Monitoring: Conduct regular scans of large codebases to prevent 'dependency rot' and ensure all third-party libraries remain compatible with the current development environment.
| name | dependency-analyzer |
|---|---|
| description | Analyzes project dependencies, detects outdated packages, identifies breaking changes, and suggests safe update strategies. Helps maintain dependency health and security. |
| context | fork: true |
| model | sonnet |
| allowed-tools | read, write, glob, search, codebase_search, Bash |
| version | 1.0 |
| error_handling | graceful |
| streaming | supported |
| templates | [dependency-report, update-plan, security-audit] |
Dependency Analyzer Skill - Analyzes project dependencies, detects outdated packages, identifies breaking changes, and suggests safe update strategies.
- Analyzing dependency health
- Planning dependency updates
- Detecting security vulnerabilities
- Identifying breaking changes
- Validating compatibility
Step 1: Identify Dependency Files
Locate dependency files:
package.json(Node.js)requirements.txt(Python)go.mod(Go)Cargo.toml(Rust)pom.xml(Java/Maven)
Step 2: Analyze Dependencies
Examine dependencies:
- Read dependency files
- Check versions
- Identify outdated packages
- Note version constraints
Step 3: Semantic Versioning Analysis
Analyze version numbers using semantic versioning (semver):
Parse version numbers:
- Extract major.minor.patch from version strings
- Handle version ranges (^, ~, >=, etc.)
- Identify exact vs range versions
Detect major version bumps:
- Compare current version with latest available
- Identify major version changes (e.g., 1.x.x -> 2.x.x)
- Flag major updates as potentially breaking
Check changelogs for breaking changes:
- For major version updates: Trigger web search (Exa/WebFetch) to research breaking changes
- Look for "BREAKING CHANGE" markers in changelogs
- Check migration guides
- Review release notes for breaking changes
- Document specific breaking changes found
Semantic Versioning Rules:
- Major version (X.0.0): Breaking changes likely, requires code changes
- Minor version (0.X.0): New features, backward compatible
- Patch version (0.0.X): Bug fixes, backward compatible
Breaking Change Detection:
- Parse changelog entries for breaking change indicators
- Identify deprecated APIs
- Check for removed features
- Document migration requirements
- Generate breaking change report
Step 4: Check for Updates
Check available updates:
- Query package registries
- Compare current vs latest versions
- Identify major/minor/patch updates
- Apply semantic versioning analysis
- Warn about breaking changes
Step 4: Security Audit
Check for vulnerabilities:
- Scan for known vulnerabilities
- Check security advisories
- Identify high-risk packages
- Suggest security updates
Step 5: Generate Report
Create dependency report:
- List outdated packages
- Identify breaking changes
- Suggest update strategy
- Provide migration guidance
Integration with Security Architect Agent:
- Reviews security vulnerabilities
- Validates security updates
- Ensures compliance
- Regular Analysis: Analyze dependencies regularly
- Security First: Prioritize security updates
- Test Updates: Always test after updates
- Gradual Updates: Update incrementally
- Document Changes: Track update decisions
# Dependency Health Report
## Summary
- Total Dependencies: 45
- Outdated: 12
- Vulnerable: 3
- Up to Date: 30
## Outdated Packages
- react: 18.0.0 → 18.2.0 (minor update)
- next: 13.4.0 → 14.0.0 (major update - breaking changes)
- typescript: 5.0.0 → 5.3.0 (patch update)
## Security Vulnerabilities
- lodash: 4.17.20 (CVE-2021-23337) - Update to 4.17.21
- axios: 0.21.1 (CVE-2021-3749) - Update to 1.6.0
## Update Recommendations
1. Update patch versions (safe)
2. Review minor updates (low risk)
3. Plan major updates (breaking changes)
# Dependency Update Plan
## Phase 1: Patch Updates (Safe)
- Update lodash: 4.17.20 → 4.17.21
- Update typescript: 5.0.0 → 5.3.0
## Phase 2: Minor Updates (Low Risk)
- Update react: 18.0.0 → 18.2.0
- Update @types/node: 20.0.0 → 20.10.0
## Phase 3: Major Updates (Breaking Changes)
- Update next: 13.4.0 → 14.0.0
- Breaking changes: [List]
- Migration steps: [Steps]
- Testing required: [Tests]
# Analyze dependencies
Analyze dependencies for this project
# Check for updates
Check for dependency updates
# Security audit
Perform security audit of dependencies
# Generate update plan
Generate update plan for major version updates