native-dependency-update

Automate native dependency updates across DEPS, cgmanifest, and submodules in SkiaSharp's Skia fork.

5.5k|644|Updated Feb 22, 2016

Search Tags:#upgrade #submodule #cve #dependency #skiasharp #skia #cgmanifest

Ready to run

npx skills add https://github.com/mono/SkiaSharp --skill native-dependency-update

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: native-dependency-update
Source: https://github.com/mono/SkiaSharp/tree/main/.github/skills/native-dependency-update
Command: npx skills add https://github.com/mono/SkiaSharp --skill native-dependency-update

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

SkiaSharp's Skia fork relies on multiple native libraries; keeping them secure and up-to-date across DEPS and submodules is error-prone and time-consuming.

Core Features & Use Cases

Detects outdated or vulnerable dependencies (libpng, libexpat, zlib, libwebp, harfbuzz, freetype, libjpeg-turbo, etc.)
Coordinates updates across externals/skia, cgmanifest.json, and submodules, and prepares PRs
Supports breaking-change analyses and CVE remediation workflows

Quick Start

Initiate a native dependency bump workflow and submit PRs updating DEPS and cgmanifest.

Frequently Asked Questions about native-dependency-update

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I update native dependencies in a Skia fork to fix CVEs?▼

To update native dependencies in a Skia fork, you must coordinate changes across DEPS, cgmanifest.json, and submodule references. This workflow automates vulnerability detection, applies security patches to libraries like libpng and zlib, and prepares coordinated pull requests.

What is the best way to manage submodule references and DEPS for libpng or zlib upgrades?▼

The best way to manage submodule references and DEPS for library upgrades is by synchronizing cgmanifest entries and submodule pins. This process detects outdated externals for libpng, zlib, and other libraries, then prepares pull requests for compliance checks.

Can I use this workflow to analyze breaking changes when bumping libwebp or harfbuzz?▼

Yes, you can analyze breaking changes when bumping libwebp or harfbuzz. The workflow supports breaking-change analyses across native dependencies, ensuring version bumps and CVE remediation workflows are validated through local builds and tests before merging.

Does updating SkiaSharp native libraries require local build and test validation before merge?▼

Yes, updating SkiaSharp native libraries requires local build and test validation before merge. The workflow enforces coordinated PR workflows and compliance checks to ensure dependency updates across externals and submodules do not introduce breaking changes.

Why does updating freetype or libjpeg-turbo in SkiaSharp require coordinating cgmanifest updates?▼

Updating freetype or libjpeg-turbo requires coordinating cgmanifest updates because SkiaSharp relies on multiple native libraries tracked across DEPS and submodules. Synchronizing the cgmanifest ensures compliance checks pass and maintains accurate dependency records during version bumps.