| name | analyze-dependencies |
| description | Reads one or more Dockerfiles and produces a structured catalog of every pinned dependency version, grouped by source type (go-module, npm-package, github-release, maven-central, debian-snapshot). Use when preparing a version-update workflow, auditing dependency freshness, or identifying which packages in a Dockerfile need a version bump. |
Analyze Dependencies
Extracts every version-pinned dependency from a Dockerfile and groups it by source type so the next step knows exactly where to look for newer releases.
Instructions
Step 1: Locate the Target Dockerfile
Read the Dockerfile path supplied by the caller. If none is given, find the most recently named version directory under vscode-devcontainer/versions/ and read its Dockerfile.
Step 2: Extract All Versioned Entries
Scan the file for version strings in these patterns:
| Pattern | Example |
|---|
ARG NAME=value at global scope | ARG GO_VERSION=1.26.1 |
ENV NAME=value in any stage | ENV FLYWAY_VERSION=9.9.0 |
Multi-line ENV blocks | TBLS_VERSION=v1.94.4 \ |
Inline version in a RUN command (no ENV var) | @v1.2.3 in a go install line |
Step 3: Assign Source Type to Each Entry
| Source Type | Signals |
|---|
go-module | installed via go install <module>@${VAR} |
npm-package | installed via npm install -g "pkg@${VAR}" |
github-release | downloaded via curl from github.com/…/releases/download/… |
maven-central | downloaded via curl from repo1.maven.org/maven2/… |
debian-snapshot | a dated Debian suite tag (e.g. trixie-20260406) |
unpinned | installed with @latest — intentionally unversioned; skip |
Step 4: Identify Coordination Constraints
Flag pairs or groups where a version change in one entry requires a matching change in another:
- Go SDK ↔ Delve:
GO_VERSION and DELVE_VERSION must be compatible — Delve tracks the Go major version.
- Archgate version ↔ SHA:
ARCHGATE_VERSION always has a companion ARCHGATE_GIT_SHA that must be updated together. The SHA is obtained via npm view archgate@<version> gitHead.
- Debian suite ↔ apt packages: Changing
DEBIAN_VERSION affects all packages installed from apt.
Step 5: Output the Catalog
Produce a Markdown table followed by a coordination warnings section.
## Dependency Catalog
| Variable | Current Version | Package / Module | Source Type | Coordination |
|---|---|---|---|---|
| GO_VERSION | 1.26.1 | golang | github-release | Update DELVE_VERSION together |
| DEBIAN_VERSION | trixie-20260406 | debian:trixie | debian-snapshot | Affects all apt installs |
| TBLS_VERSION | v1.94.4 | github.com/k1LoW/tbls | go-module | none |
| ... | ... | ... | ... | ... |
## Unpinned (Skip)
- gopls — installed @latest intentionally
- goimports — installed @latest intentionally
## Coordination Warnings
- GO_VERSION and DELVE_VERSION must be updated together.
- ARCHGATE_VERSION requires ARCHGATE_GIT_SHA to be updated via `npm view archgate@<version> gitHead`.
Common Issues
Multi-architecture variables: Some tools set an arch-specific variable (e.g. GITLEAKS_ARCH) derived from TARGETARCH. Catalog the base version ENV var only; ignore the arch-selector.
Inline versions with no ENV var: If a version string appears directly in a RUN command without a backing ENV var, add it to the catalog as (inline) in the Variable column and flag it for extraction into an ENV var before updating.
FROM image tags: Include the base image tags (e.g. golang:${GO_VERSION}-bookworm, debian:${DEBIAN_VERSION}) as implicit consumers of the ARG values — do not add them as separate rows.
