dependency-update-review

Automating dependency review involves evaluating direct and transitive changes to identify major version upgrades and assess package behavior impact. This Skill requires access to project manifests, lockfiles, and runtime versions to safely review updates and perform security audits without manual checks.

The best way to assess dependency update risks is to evaluate major version upgrades, direct and transitive changes, and package behavior impacts. This process identifies potential vulnerabilities and suggests targeted validation commands to ensure software maintenance safety.

Reviewing major version upgrades for transitive dependencies requires analyzing lockfiles and project manifests to map behavioral changes. This Skill evaluates transitive impacts to determine if package updates introduce compatibility issues or security vulnerabilities.

Yes, performing a security audit on package updates requires project manifests and lockfiles. Access to these files, alongside runtime versions, allows the dependency review process to accurately evaluate direct and transitive changes for compatibility and security risks.

Limitations in dependency update reviews stem from incomplete manifest or lockfile access, which prevents accurate evaluation of transitive changes. Without proper runtime version context, risk assessments for major version upgrades may fail to identify specific package behavior impacts accurately.