playbooks

home / skills / jeremylongshore / claude-code-plugins-plus-skills / windsurf-dependency-management

windsurf-dependency-management skill

/plugins/saas-packs/skill-databases/windsurf/skills/windsurf-dependency-management

This skill analyzes dependencies, detects vulnerabilities, and guides safe updates across npm, yarn, pnpm, and pip to strengthen Windsurf projects.

npx playbooks add skill jeremylongshore/claude-code-plugins-plus-skills --skill windsurf-dependency-management

Review the files below or copy the command above to add this skill to your agents.

Files (5)
SKILL.md
2.0 KB
---
name: "windsurf-dependency-management"
description: |
  Analyze and update dependencies with vulnerability scanning. Activate when users mention
  "update dependencies", "security audit", "npm audit", "vulnerability scan",
  or "dependency updates". Handles dependency analysis and updates. Use when working with windsurf dependency management functionality. Trigger with phrases like "windsurf dependency management", "windsurf management", "windsurf".
allowed-tools: "Read,Write,Edit,Bash(cmd:*),Grep"
version: 1.0.0
license: MIT
author: "Jeremy Longshore <[email protected]>"
---

# Windsurf Dependency Management

## Overview

This skill enables comprehensive dependency management within Windsurf projects. Cascade analyzes your dependency tree, identifies security vulnerabilities, suggests safe updates, and helps plan migration paths for major version upgrades. It integrates with npm, yarn, pnpm, pip, and other package managers to provide actionable security insights and update recommendations.

## Prerequisites

- Windsurf IDE with Cascade enabled
- Package manager installed (npm, yarn, pnpm, pip)
- Project with package.json, requirements.txt, or equivalent
- Understanding of semantic versioning
- CI/CD pipeline for testing updates (recommended)

## Instructions

1. **Run Initial Audit**
2. **Analyze Update Paths**
3. **Plan Updates**
4. **Apply and Verify**
5. **Establish Monitoring**


See `{baseDir}/references/implementation.md` for detailed implementation guide.

## Output

- Security audit report with findings
- Update plan with prioritized changes
- Compatibility matrix for version combinations
- Migration guides for breaking changes

## Error Handling

See `{baseDir}/references/errors.md` for comprehensive error handling.

## Examples

See `{baseDir}/references/examples.md` for detailed examples.

## Resources

- [Windsurf Dependency Management](https://docs.windsurf.ai/features/dependencies)
- [npm Audit Documentation](https://docs.npmjs.com/cli/audit)
- [Semantic Versioning Spec](https://semver.org/)

Overview

This skill provides automated dependency analysis and secure update recommendations for Windsurf projects. It runs vulnerability scans, prioritizes fixes, and produces an actionable update plan including migration notes for breaking changes. Use it to reduce dependency risk and streamline upgrade work within the Windsurf environment.

How this skill works

The skill inspects project manifests (package.json, requirements.txt, etc.), builds a dependency tree, and runs vulnerability scans against known advisories and score databases. It suggests safe semver-based updates, flags major-version breaking changes, and generates a prioritized plan with compatibility notes. Integrations support npm, yarn, pnpm, pip and output artifacts suited for CI/CD verification.

When to use it

  • When you need a security audit or vulnerability scan for dependencies
  • Before merging dependency updates into main or a release branch
  • When preparing a major version upgrade or migration plan
  • When automating dependency updates in CI/CD pipelines
  • If you see failing audits like "npm audit" or vulnerability alerts in Snyk/GitHub

Best practices

  • Run the initial audit on a clean CI environment and capture the full dependency tree
  • Prefer smallest safe semver bumps for patch and minor fixes; plan major upgrades separately
  • Keep automated tests and CI checks to verify updates before merging
  • Use the generated compatibility matrix to test critical version combinations
  • Schedule regular scans and monitor new advisories rather than doing one-off updates

Example use cases

  • Perform a full windsrf dependency management audit to produce an update plan and migration notes
  • Automate routine npm audit fixes for non-breaking updates and create PRs with change logs
  • Analyze a major library upgrade, get a compatibility matrix, and receive step-by-step migration guidance
  • Integrate scans into CI to block merges with high-severity vulnerabilities and produce findings artifacts
  • Generate a prioritized remediation list for a security review or compliance audit

FAQ

Which package managers does this support?

It supports npm, yarn, pnpm, pip and other common managers by reading the project manifest and lockfiles.

Will it automatically update my code for breaking changes?

No. It recommends safe updates and produces migration guidance for breaking changes; applying and adapting code requires manual review and testing.