dependency-doctor

# dependency-doctor ## Purpose Dependency health management covering outdated packages, known vulnerabilities, and update planning. Detects the package manager automatically, runs audit commands, analyzes breaking changes for major version bumps, and outputs a prioritized update plan with risk assessment. ## Called By (inbound) - `rescue` (L1): Phase 0 dependency health assessment - `audit` (L2): Phase 1 vulnerability scan and outdated dependency check ## Calls (outbound) None — pure L3 utility using Bash for package manager commands. ## Executable Instructions ### Step 1: Detect Package Manager Use `Glob` to find dependency files in the project root: - `package.json` → Node.js (npm, yarn, or pnpm) - `requirements.txt` or `pyproject.toml` → Python (pip or uv) - `Cargo.toml` → Rust (cargo) - `go.mod` → Go (go) - `Gemfile` → Ruby (bundler) If multiple are found, process all of them. If none found, report NO_DEPENDENCY_FILES and stop. For Node.js, further detect the package manager: - `yarn.lock` present → yarn - `pnpm-lock.yaml` present → pnpm - `package-lock.json` present → npm - None → default to npm ### Step 2: List Dependencies Use `Read` to parse the dependency file and extract: - Package name - Current version constraint - Whether it is a dev dependency or production dependency For `package.json`, read both `dependencies` and `devDependencies` sections. ### Step 3: Check Outdated Run the appropriate command via `Bash` to find outdated packages: **npm:** ...