dep-upgrade

name	dep-upgrade
description	Safe systematic dependency upgrade with vulnerability scanning and rollback capability. Detects project ecosystem, audits outdated and vulnerable packages, presents a prioritized upgrade plan, and executes upgrades one at a time with test verification after each. Use when updating dependencies, fixing vulnerability alerts, or performing periodic dependency maintenance.
compatibility	Requires at least one package manager (go, npm, pip, cargo, dotnet). Works with Go, Node.js, Python, Rust, and .NET projects.

Safe Dependency Upgrade

Systematically upgrade dependencies with zero breakage. Detects the project ecosystem, audits for outdated and vulnerable packages, presents a prioritized plan for approval, then executes upgrades one at a time with test verification after each.

Core principle: One upgrade at a time. Test after each. Roll back on failure. Never auto-commit.

Prerequisite check

Detect the project ecosystem by scanning for package manager files:

ls go.mod package.json pyproject.toml Cargo.toml *.csproj 2>/dev/null

If no package manager file is found, report to the user and stop. Mixed projects (e.g., Go backend + Node frontend) are supported — audit and upgrade each ecosystem separately.

Step 1: Audit dependencies

List outdated packages and run vulnerability scanners for each detected ecosystem.

Go:

go list -u -m all 2>/dev/null | grep '\['
govulncheck ./... 2>/dev/null

Node.js:

npm outdated 2>/dev/null
npm audit 2>/dev/null