| name | deps |
| description | Manage dependencies and fix CVEs — check outdated packages, update a specific package, run security audit, explain why a package is installed, or deduplicate. Read brain/cve-policy.md for the decision tree. |
Deps Skill
Manage project dependencies following the CVE decision tree.
Usage
$deps check # Show outdated packages
$deps update lodash # Update specific package
$deps audit # Run security audit
$deps why express # Explain why a package is installed
$deps dedupe # Deduplicate dependency tree
Instructions
First: Read brain/cve-policy.md for the CVE decision tree.
Determine action from $ARGUMENTS:
| Argument | Action |
|---|
check | Show outdated packages |
update <package> | Update specific package |
audit | npm audit / pip audit / cargo audit / bundle audit |
why <package> | npm why <package> / pip show <package> |
dedupe | npm dedupe / pnpm dedupe |
| (empty) | Run check + audit |
By Package Manager:
npm / pnpm / yarn:
pnpm outdated 2>&1 | head -40
pnpm audit --audit-level moderate 2>&1 | head -40
pip / uv / poetry:
pip list --outdated 2>&1 | head -30
pip-audit 2>&1 | head -40
cargo:
cargo outdated 2>&1 | head -30
cargo audit 2>&1 | head -40
CVE Response Rules (from brain/cve-policy.md):
- Critical/High severity → upgrade immediately, test, PR same day
- Medium severity → schedule within current sprint
- Low severity → batch with next dependency update cycle
- NEVER blindly upgrade majors — check breaking changes first
