ClawHub

Cuihua Dependency Updater

Dev Tools

๐Ÿ“ฆ AI-powered dependency update assistant. Intelligently update npm/yarn packages with safety checks, breaking change detection, and automated testing. Keep dependencies fresh without breaking your app.

Install

openclaw skills install cuihua-dependency-updater

cuihua-dependency-updater ๐Ÿ“ฆ

Keep dependencies fresh, keep your app safe

AI-powered dependency management that updates packages intelligently:

  • ๐Ÿ”’ Security-first - Prioritize security patches
  • ๐Ÿ›ก๏ธ Safe updates - Detect breaking changes before updating
  • ๐Ÿค– Smart batching - Group compatible updates
  • ๐Ÿ“ Auto changelog - Generate update summaries
  • โฎ๏ธ Easy rollback - Undo problematic updates

๐ŸŽฏ Why cuihua-dependency-updater?

The problem:

  • โŒ npm outdated shows 50+ packages to update
  • โŒ No idea which ones are safe to update
  • โŒ Breaking changes break your app
  • โŒ Security patches mixed with feature updates
  • โŒ Manual updates take hours

cuihua-dependency-updater solves this.

๐Ÿš€ Quick Start

Check for updates

"Check outdated dependencies"

Output:

๐Ÿ“ฆ Dependency Update Report
โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”

๐Ÿ”ด Security updates (3):
  - lodash: 4.17.19 โ†’ 4.17.21 (CVE-2020-8203)
  - minimist: 1.2.5 โ†’ 1.2.6 (CVE-2021-44906)
  - axios: 0.21.1 โ†’ 1.6.0 (CVE-2023-45857)

๐ŸŸก Breaking changes (2):
  - webpack: 4.46.0 โ†’ 5.89.0 (Major version)
  - react: 17.0.2 โ†’ 18.2.0 (Major version)

๐ŸŸข Safe updates (12):
  - typescript: 4.9.5 โ†’ 5.3.3 (Minor)
  - eslint: 8.50.0 โ†’ 8.56.0 (Patch)
  ...

๐Ÿ’ก Recommendation: Update security first

Update by priority

"Update security vulnerabilities"

Generated:

npm update lodash minimist axios
npm audit fix

Smart batch update

"Update all safe dependencies"

Automatically:

  1. Groups compatible updates
  2. Tests each batch
  3. Rolls back if tests fail
  4. Generates changelog

๐ŸŽจ Features

1. Intelligent Prioritization ๐ŸŽฏ

Updates are categorized by risk and impact:

{
  "security": [
    { package: "lodash", severity: "high", cve: "CVE-2020-8203" }
  ],
  "breaking": [
    { package: "webpack", from: "4.x", to: "5.x", impact: "high" }
  ],
  "safe": [
    { package: "typescript", from: "4.9", to: "5.3", impact: "low" }
  ]
}

2. Breaking Change Detection ๐Ÿ”

AI analyzes changelogs and API changes:

โš ๏ธ  Breaking changes detected in react@18:

1. ReactDOM.render โ†’ createRoot
   Impact: ALL entry points need updates
   
2. Automatic batching
   Impact: State updates may batch differently
   
3. Stricter hydration
   Impact: SSR apps may break

Recommendation: Schedule major update separately
Estimated effort: 2-4 hours

3. Security Scanning ๐Ÿ”’

Integrates with npm audit and vulnerability databases:

๐Ÿ”ด HIGH severity vulnerability
โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”

Package: lodash@4.17.19
CVE: CVE-2020-8203
Severity: HIGH
Impact: Prototype pollution

Affected paths:
  - app โ†’ lodash (direct)
  - webpack โ†’ lodash (indirect)

Fix available: lodash@4.17.21
Risk: LOW (patch version)

๐Ÿš€ Safe to update immediately

4. Automated Testing ๐Ÿงช

Run tests after each update batch:

async function safeUpdate(packages) {
  // Backup current state
  const backup = await saveState();
  
  try {
    // Update packages
    await npm.update(packages);
    
    // Run tests
    const testsPassed = await runTests();
    
    if (!testsPassed) {
      throw new Error('Tests failed');
    }
    
    console.log('โœ… Update successful');
    
  } catch (error) {
    // Rollback on failure
    await restore(backup);
    console.log('โฎ๏ธ  Rolled back due to:', error.message);
  }
}

5. Changelog Generation ๐Ÿ“

Auto-generate human-readable update summaries:

# Dependency Updates - 2026-03-24

## Security Fixes (3)
- lodash: 4.17.19 โ†’ 4.17.21
  - Fixed: Prototype pollution vulnerability
  - CVE: CVE-2020-8203
  
- axios: 0.21.1 โ†’ 1.6.0
  - Fixed: SSRF vulnerability
  - CVE: CVE-2023-45857

## Feature Updates (5)
- typescript: 4.9.5 โ†’ 5.3.3
  - Added: Better type inference
  - Added: Decorators support
  
- eslint: 8.50.0 โ†’ 8.56.0
  - Fixed: Several bugs
  - Added: New rules

## Breaking Changes (Postponed)
- webpack: 4.46.0 โ†’ 5.89.0
  - Reason: Requires configuration migration
  - Estimated effort: 4 hours
  - Scheduled: Next sprint

๐Ÿ“‹ Usage Examples

Example 1: Security Audit

User: "Audit dependencies for security issues"

Agent:

๐Ÿ” Security Audit Report
โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”

Total packages: 1,234
Vulnerabilities: 8

๐Ÿ”ด CRITICAL (1)
  - express-fileupload@1.1.7
    CVE-2020-7699 (RCE)
    Fix: Update to 1.4.0

๐ŸŸ  HIGH (3)
  - lodash@4.17.19 โ†’ 4.17.21
  - minimist@1.2.5 โ†’ 1.2.6
  - axios@0.21.1 โ†’ 1.6.0

๐ŸŸก MEDIUM (4)
  - qs@6.5.2 โ†’ 6.11.0
  - ...

๐Ÿ’ก Action: npm audit fix --force
Risk: All fixes are patch/minor versions

Example 2: Major Version Update

User: "Can I safely update React to v18?"

Agent:

๐Ÿ” Analyzing React 17 โ†’ 18 migration...

โœ… Compatibility Check:
  - react-dom: Compatible
  - react-router: Needs update to v6
  - redux: Compatible
  - typescript: Compatible

โš ๏ธ  Breaking Changes:
  1. ReactDOM.render API removed
     Files affected: 2 (src/index.js, src/test-utils.js)
     
  2. Automatic batching changes
     Potential impact: State update timing
     
  3. Stricter TypeScript types
     Files affected: 15

๐Ÿ“Š Migration complexity: MEDIUM
Estimated time: 2-3 hours
Recommendation: Update in separate PR

๐Ÿ”ง Migration steps:
  1. Update packages
  2. Replace ReactDOM.render
  3. Fix TypeScript errors
  4. Test thoroughly
  
Want me to generate a migration guide?

Example 3: Batch Update

User: "Update all safe dependencies"

Agent:

๐Ÿ“ฆ Preparing batch update...

Grouped into 3 batches:

Batch 1 (Testing tools - 5 packages):
  - jest: 29.5.0 โ†’ 29.7.0
  - @testing-library/react: 14.0.0 โ†’ 14.1.2
  - ...

Batch 2 (Build tools - 4 packages):
  - vite: 5.0.0 โ†’ 5.0.10
  - esbuild: 0.19.0 โ†’ 0.19.11
  - ...

Batch 3 (Utils - 8 packages):
  - date-fns: 2.30.0 โ†’ 3.0.6
  - lodash: 4.17.19 โ†’ 4.17.21
  - ...

Process:
1. Update Batch 1 โ†’ Run tests โ†’ โœ…
2. Update Batch 2 โ†’ Run tests โ†’ โœ…
3. Update Batch 3 โ†’ Run tests โ†’ โœ…

โœ… All updates successful!
๐Ÿ“ Changelog: UPDATES.md

โš™๏ธ Configuration

Create .dependencyrc.json:

{
  "updateStrategy": "conservative",
  "priorities": [
    "security",
    "patch",
    "minor",
    "major"
  ],
  "autoUpdate": {
    "security": true,
    "patch": true,
    "minor": false,
    "major": false
  },
  "testing": {
    "runTests": true,
    "testCommand": "npm test",
    "rollbackOnFail": true
  },
  "exclude": [
    "react",
    "webpack"
  ],
  "changelog": {
    "generate": true,
    "path": "./UPDATES.md"
  }
}

๐Ÿ”ง Update Strategies

Conservative (Default)

  • Security: Auto-update
  • Patch: Auto-update
  • Minor: Manual review
  • Major: Manual review

Aggressive

  • Security: Auto-update
  • Patch: Auto-update
  • Minor: Auto-update
  • Major: Manual review

Custom

Define your own rules per package:

{
  "packages": {
    "lodash": "aggressive",
    "react": "manual",
    "typescript": "conservative"
  }
}

๐Ÿ’ฐ Pricing

Free

  • โœ… Dependency analysis
  • โœ… Security scanning
  • โœ… Up to 100 packages

Pro ($10/month)

  • โœ… Unlimited packages
  • โœ… Automated updates
  • โœ… CI/CD integration
  • โœ… Custom strategies

Enterprise ($79/month)

  • โœ… Team policies
  • โœ… Monorepo support
  • โœ… Advanced rollback
  • โœ… Compliance reports

๐Ÿ“š Resources

๐Ÿ“œ License

MIT

๐Ÿ™ Acknowledgments

Built with ๐ŸŒธ by ็ฟ ่Šฑ (Cuihua)

Made with ๐ŸŒธ | Cuihua Series | ClawHub Pioneer

Keep dependencies fresh, keep your app safe.

More in Dev Tools