dependency-analyzer

name	dependency-analyzer
description	Dependency tree analysis, version conflict resolution, update planning, and bundle size optimization
layer	utility
category	devtools
triggers	["dependency","dependencies","package update","bundle size","dependency tree","version conflict","npm audit","outdated packages"]
inputs	[{"manifest":"Package manifest (package.json, requirements.txt, go.mod, Cargo.toml)"},{"concerns":"Security vulnerabilities, bundle size, version conflicts, update planning"},{"constraints":"Breaking change tolerance, framework compatibility requirements"}]
outputs	[{"dependency_report":"Analysis of current dependency state"},{"update_plan":"Prioritized list of updates with risk assessment"},{"bundle_analysis":"Bundle size impact of dependencies"},{"conflict_resolution":"Resolution steps for version conflicts"},{"alternative_suggestions":"Lighter or more maintained alternatives"}]
linksTo	["security-scanner","optimize","cicd"]
linkedFrom	["audit","ship","code-review"]
preferredNextSkills	["security-scanner","optimize"]
fallbackSkills	["research"]
riskLevel	low
memoryReadPolicy	selective
memoryWritePolicy	none
sideEffects	["May read package manifests and lockfiles","May run analysis commands (npm ls, npm audit)"]

Dependency Analyzer Skill

Purpose

Analyze, audit, and optimize project dependencies. This skill examines dependency trees for security vulnerabilities, version conflicts, bundle size bloat, and maintenance risk. It produces actionable update plans that balance security, stability, and performance.

Key Concepts

Dependency Health Metrics

SECURITY:      Are there known CVEs? How quickly are they patched?
MAINTENANCE:   Last publish date, open issues, commit frequency
POPULARITY:    Weekly downloads, GitHub stars (proxy for community support)
SIZE:          Install size, bundle size (for frontend deps)
ALTERNATIVES:  Are there lighter, more maintained alternatives?
LICENSE:       Is the license compatible with the project?

Dependency Categories

DIRECT (listed in package.json dependencies):
  - You chose these. You are responsible for updating them.
  - Security vulnerabilities here are your highest priority.

TRANSITIVE (dependencies of your dependencies):
  - You did not choose these. They come along for the ride.
  - Vulnerabilities may or may not be exploitable via your usage.

DEV (devDependencies):
  - Not shipped to production. Lower security priority.
  - But still a supply chain risk (build-time attacks).

PEER (peerDependencies):
  - Version must be compatible with the host package.
  - Mismatches cause subtle runtime bugs.

Workflow

Phase 1: Current State Analysis

# Node.js ecosystem
npm ls --depth=0              # Direct dependencies
npm ls --all                  # Full tree
npm outdated                  # Check for updates
npm audit                     # Security vulnerabilities

# Bundle size analysis
npx @next/bundle-analyzer     # Next.js specific
npx source-map-explorer dist/main.js  # Generic
npx bundlephobia-cli react    # Check size before installing

# Unused dependency detection
npx depcheck                  # Find unused packages

# Python
pip list --outdated
pip-audit
pipdeptree

# Go
go list -m all
govulncheck ./...

Phase 2: Risk Assessment

UPDATE RISK MATRIX:

               Low Breaking Risk        High Breaking Risk
High Security  | UPDATE IMMEDIATELY  |  UPDATE + TEST HEAVILY  |
Risk           | (patch/minor)       |  (major version)        |
               |---------------------|-------------------------|
Low Security   | UPDATE IN NEXT      |  PLAN MIGRATION         |
Risk           | SPRINT              |  (schedule + allocate)  |