Smart Dependency Tool

Audit, update, and manage project dependencies with vulnerability scanning, version compatibility checks, and automated upgrade recommendations across package ecosystems.

When to Use This Command

Run this command when...

• You need to audit all project dependencies for known security vulnerabilities and outdated versions
• You want to safely upgrade packages with automatic compatibility checks before applying changes
• You need to identify unused dependencies that bloat your bundle size and slow install times
• You want a unified dependency management workflow across npm, pip, cargo, go modules, or NuGet ecosystems
• You need to generate a dependency report for compliance reviews or security audits

Quick Start

Copy
# .claude/commands/smart-dependency-tool.yaml
name: Smart Dependency Tool
description: Audit, update, and manage dependencies with vulnerability scanning
inputs:
  - name: action
    description: "audit, update, prune, or report"
    default: "audit"

Copy
# Run a full dependency audit
claude "smart-dependency-tool audit"

# Update all packages with compatibility checks
claude "smart-dependency-tool update --safe"

# Find and remove unused dependencies
claude "smart-dependency-tool prune"

Output:
  [detect] Package manager: npm (package.json)
  [audit] Scanning 142 dependencies...
  Security Issues:
    Critical: 1 (lodash < 4.17.21)
    High:     2 (axios, express-session)
    Medium:   5
  Outdated: 23 packages have newer versions
  Unused:   4 packages detected (estimated -180KB)
  Done. Run with --fix to apply safe updates.

Core Concepts

Concept	Description
Multi-Ecosystem Support	Works with npm, pip, cargo, go mod, NuGet, and composer package managers
Vulnerability Scanning	Cross-references installed versions against CVE databases and advisory feeds
Safe Updates	Upgrades within semver-compatible ranges first, flags breaking changes for manual review
Unused Detection	Analyzes import statements and require calls to find installed packages never referenced in code
Compliance Reporting	Generates license inventories and flags copyleft or restricted licenses

Dependency Analysis:
  ┌─────────────┐    ┌─────────────┐    ┌─────────────┐
  │   Detect    │───>│    Scan     │───>│  Classify   │
  │  Ecosystem  │    │  Versions   │    │   Issues    │
  └─────────────┘    └─────────────┘    └──────┬──────┘
                                               │
                     ┌─────────┬───────────────┤
                     ▼         ▼               ▼
               ┌──────────┐ ┌──────┐    ┌──────────┐
               │Vulnerable│ │Unused│    │ Outdated │
               └──────────┘ └──────┘    └──────────┘

Configuration

Parameter	Type	Default	Description
action	string	"audit"	Operation: audit, update, prune, or report
safe	boolean	true	Only apply semver-compatible updates, flag breaking changes
severity	string	"medium"	Minimum vulnerability severity to report: low, medium, high, critical
fix	boolean	false	Automatically apply recommended fixes and updates
ecosystem	string	auto-detected	Force a specific package manager: npm, pip, cargo, gomod

Best Practices

1. Run audits in CI pipelines -- Add smart-dependency-tool audit to your CI workflow to catch new vulnerabilities on every pull request before they reach production.
2. Update incrementally, not all at once -- Updating one package at a time with tests between each makes it easy to identify which upgrade introduced a regression.
3. Prune before auditing -- Removing unused dependencies first reduces the attack surface and makes audit results more focused on packages that actually matter.
4. Review breaking changes manually -- When the tool flags a major version update, read the changelog and migration guide before applying. Automated updates cannot catch API behavior changes.
5. Generate compliance reports quarterly -- License audits catch new copyleft dependencies that may conflict with your project's licensing terms. Generate and review reports regularly.

Common Issues

1. Lock file out of sync -- If package-lock.json or equivalent is out of sync with the manifest, audit results may be inaccurate. Run npm install or equivalent first to regenerate the lock file.
2. False positives in unused detection -- Packages used only in build scripts, configuration files, or dynamically required may be flagged as unused. Review the prune list before removing.
3. Network access required for CVE checks -- Vulnerability scanning queries online advisory databases. Ensure network access is available or provide an offline advisory cache.