---
name: Dependency Triage
slug: dependency-triage-2
category: DevOps
description: Dependency Triage scans package manifests and lockfiles for outdated packages and known CVEs, grouping updates by risk (patch, minor, major). Use it in dependency sweeper loops to decide which updates are safe to apply automatically and which need human escalation.
github: "https://github.com/cobusgreyling/loop-engineering/tree/main/starters/dependency-sweeper/.claude/skills/dependency-triage"
language: JavaScript
stars: 10380
forks: 1410
install: "npx degit https://github.com/cobusgreyling/loop-engineering/tree/main/starters/dependency-sweeper/.claude/skills/dependency-triage ~/.claude/skills/dependency-triage"
installs_to: ~/.claude/skills/dependency-triage
source_path: starters/dependency-sweeper/.claude/skills/dependency-triage/SKILL.md
collection_size: 23
category_size: 798
collection_url: "https://dirskills.com/collections/cobusgreyling/loop-engineering"
added: 2026-08-15T06:50:32.441Z
last_synced: 2026-08-15T06:50:32.441Z
canonical_url: "https://dirskills.com/skills/dependency-triage-2"
---

# Dependency Triage

Dependency Triage scans package manifests and lockfiles for outdated packages and known CVEs, grouping updates by risk (patch, minor, major). Use it in dependency sweeper loops to decide which updates are safe to apply automatically and which need human escalation.

**Install:**

```bash
npx degit https://github.com/cobusgreyling/loop-engineering/tree/main/starters/dependency-sweeper/.claude/skills/dependency-triage ~/.claude/skills/dependency-triage
```

## README

# Dependency Triage Skill

## Output per package

```markdown
### package-name (ecosystem: npm|pip|go|etc.)
- Current: x.y.z
- Suggested: x.y.z
- Risk: patch | minor | major
- CVE: none | CVE-XXXX (severity)
- Actionable: yes | no (denylist / human gate)
- Suggested loop action: patch-in-worktree | escalate-human | skip
```

## Classification Rules

- **patch**: semver patch or lockfile-only security fix with no API change
- **minor**: semver minor — cautious, verifier required
- **major**: always escalate-human unless explicitly pre-approved in state
- **denylist**: packages in state denylist → escalate-human, no auto-touch
- **high-severity CVE**: escalate if fix requires major or breaking change

## Rules

- Prefer the smallest safe bump that resolves the advisory.
- Never bundle unrelated package updates in one change.
- Record human overrides from `dependency-sweeper-state.md` every run.
- If lockfile conflict or peer dependency warning → escalate-human.