npm · Dependency management

Walks maintainers through bumping the pinned validator package in express-validator and syncing chain types, implementations and options with the new release.

express-validator/express-validator

Recommends whether to stay on the installed Claude Code version, update, or pin another one by comparing npm tags, release timing and the changelog.

ykdojo/claude-code-tips

Audit, plan, and refresh dependency upgrades for the Logseq repository by scanning every non-gitignored package.json, deps.edn, bb.edn and nbb.edn manifest, checking latest upstream versions…

logseq/logseq

Upgrades a pinned agent SDK in the agor project, such as the Claude, Codex or Gemini CLI one, and plans the release that carries it to packaged installs.

preset-io/agor

Safely plan and execute dependency maintenance for JavaScript/TypeScript (npm, pnpm) and GitHub Actions, including npm lockfiles, pnpm workspaces, catalogs, overrides, SHA-pinned action versions…

Consensys-Incorporated/linea-attestation-registry

Bumps the pinned Electron version across the RStudio repository, updating NEWS.md, package.json, the lockfile and the allowScripts entry.

rstudio/rstudio

Manages Node.js dependencies, scripts and installs with aube, aubr and aubx, choosing the right command by its effect and preserving the project's existing lockfile and workspace format.

aubepkg/aube

Check if package.json files are in sync with pnpm-lock.yaml.

Hyk260/PureChat

Automatically fetch and fix Dependabot security alerts by querying GitHub REST API for open alerts, identifying vulnerable packages, researching secure versions, and updating package.json files…

livesession/xyd

Applies safer package manager defaults and dependency vetting to JavaScript and TypeScript projects to reduce supply-chain attack risk.

bodadotsh/npm-security-best-practices

Guides writing, running and configuring Deno 2.9+ projects: installing npm and JSR dependencies, permissions, config file precedence and the built-in fmt, lint, test and compile toolchain.

denoland/skills

Sets one monorepo's rules for toolchain pins, pnpm package operations, the shared dependency catalog and moon tasks, so the agent adds versions and scripts the right way.

pierrecomputer/pierre

Read every open Dependabot PR for an application-code dependency (Python pip/uv and JS npm/yarn/pnpm) and carry each version bump over to the local dependency files (requirements.txt…

ossf/oss-crs

审计 Node.js、Python、Go、Rust、JVM、Ruby 项目的依赖漏洞、版本健康度与许可证事实；当用户要求检查 package.json、lockfile、requirements、go.mod、Cargo.toml、pom.xml、Gemfile.lock，或生成不改依赖的中文审计报告时使用

laolaoshiren/claude-code-skills-zh

Audit repo dependencies by default and only apply library upgrades when explicitly requested.

championswimmer/TwoFac

Points the agent at Bun 1.4 built-in APIs before it installs an npm package, so image, browser, markdown, cron, PTY and test work uses what Bun already ships.

code-yeongyu/senpi

Audits outdated npm and Bun packages for supply chain integrity before bumping them, deferring risky ones and logging every decision.

backnotprop/plannotator

Fix a PR that is failing due to security or vulnerability issues — npm/pnpm/yarn/bun audit failures, CVE alerts, Dependabot merge conflicts, Snyk failures, or GitHub security advisory blocks.

unional/typescript-blackbook

Recreates every Flowfile development and build environment from scratch, with exact version pins and an explanation of what each Makefile target really does.

Edwardvaneechoud/Flowfile

Quick reference for using Bun to run TypeScript and JavaScript, install packages, bundle code, run tests and serve HTTP, with the key files and commands.

mweinbach/agent-coworker

Aligns a Lens extension's package.json ranges with the dependency versions bundled in the running Lens build, then reinstalls and rebuilds.

nevalla/lens-resource-map-extension

An extremely strict maintainability review for abstraction quality, giant files, and spaghetti-condition growth.

diyanbogdanov/emend

Keep dependencies up-to-date. An agent skill from github/rust-gems.

github/rust-gems

Scans a repository, its lockfiles and node_modules for known malicious npm package versions and install-time indicators, using a read-only Python scanner.

majiayu000/spellbook

Check dependencies for known vulnerabilities using npm audit, pip-audit, etc.

alirezarezvani/claude-code-tresor

Audits a project's dependencies for supply-chain risk: version-matched advisories for direct dependencies and the full lockfile tree, abandoned or archived upstreams, npm publisher concentration…

trailofbits/skills

A skill your agent uses when publishing or preparing to publish an npm package from this repository, especially the Skill Zoo CLI package under packages/cli.

luochang212/skill-zoo

Finds two or three well-maintained npm packages for a Front-End Checklist rule, checks download and release thresholds, and adds them to the rule's frontmatter.

thedaviddias/Front-End-Checklist

Conventions for .mjs files in the Handsontable monorepo: native node: imports, top-level await, the tasks.json dispatcher and native modules instead of extra dependencies.

handsontable/handsontable

What a dependency migration must do before it is finished, regardless of how good the code is.

diyanbogdanov/emend

Moves a Node.js, npm, Yarn, pnpm or Bun project to Deno in reversible steps, starting with Deno as the package manager and changing no code unless needed.

denoland/skills

Find all open Dependabot alerts for this repo and create a plan to resolve them using the appropriate package manager overrides (pnpm, bun, npm, cargo).

macro-inc/macro

Fix a Dependabot PR by updating all monorepo instances of the dependency, running bun install, and pushing

remotion-dev/remotion

Check every dependency in a package.json against live CVE databases and security advisories in real time — specifically targeting vulnerabilities disclosed in the last 48 hours, the window that…

tinyfish-io/tinyfish-cookbook

Supply-chain security controls for the @cipherstash/stack monorepo.

cipherstash/stack

Audit all outdated dependencies with detailed research on changelogs, breaking changes, bug fixes, and deprecations.

viclafouch/meme-studio

Check whether newer stable versions of Node.js (24.x line), Nx, or Vite are available and, if so, generate a detailed upgrade plan markdown file at the repo root.

PackmindHub/packmind

Sequences safe dependency upgrades: read the changelog, verify the version exists upstream, pin it, and keep major bumps in separate commits behind a full gate run.

dralgorhythm/claude-agentic-framework

Dependency upgrades: outdated/vulnerable deps planned into semver waves (patch/minor batched, majors gated and changelog-read), applied incrementally with lockfiles regenerated and tests green after…

maddhruv/absolute

Respond to blocked package installs and manage the Interlinked supply-chain allowlist.

QuentinCody/interlinked-cli

Master uv package manager for Python: project setup, dependency management, virtual environments, lockfiles, CI/CD integration, Docker builds, and migration from pip/poetry.

Aedelon/claude-code-blueprint

Scans deps for known CVEs via native audit (npm, pip, composer, cargo, go, bundler, dart).

softspark/ai-toolkit

Scan package manifests and lockfiles for outdated and vulnerable dependencies.

cobusgreyling/loop-engineering

Reviews Dependabot gem upgrade PRs for breaking changes, codebase impact, and merge readiness.

ThibautBaissac/rails_ai_agents

Audit project dependencies, frameworks, languages, and dev tools for known vulnerabilities, CVEs, and security anti-patterns.

briiirussell/cybersecurity-skills

Scans your project for outdated npm, pip, Cargo, Go, or Ruby packages.

Varnan-Tech/opendirectory

Flag misspelled, brandjacked, and typosquatted package names across npm, PyPI, and crates.io before installation, using edit-distance, keyboard-proximity, and known-target corpus matching with…

mukul975/Anthropic-Cybersecurity-Skills

Audit JS/TS projects against NPM Security Guidelines covering project setup, dependency hygiene, CI/CD pipeline, Dependabot, and incident response.

c0x12c/ai-toolkit