From devops-data
Aligns dependency versions and resolves conflicts for Python (uv/pip) and Node.js (npm/yarn/pnpm) projects during Tech Spec extraction in parallel development.
npx claudepluginhub jpoutrin/product-forge --plugin devops-dataThis skill uses the workspace's default tool permissions.
This skill resolves dependency versions during parallel decomposition to ensure compatibility with existing project dependencies and avoid transitive conflicts.
Audits project dependencies globally: inventories direct/transitive deps with tools like npm/pip/cargo audit, evaluates risks via matrix, plans actions (update/replace/eliminate), sets update policies.
Detects package managers (npm/yarn/pnpm, pip/uv, cargo, go, bundler), audits dependencies for outdated versions and vulnerabilities, and generates prioritized update plans with major version risk analysis.
Share bugs, ideas, or general feedback.
This skill resolves dependency versions during parallel decomposition to ensure compatibility with existing project dependencies and avoid transitive conflicts.
parallel-decompose Phase 1 (after dependency extraction, before manifest generation)| Ecosystem | Dependency Files | Package Manager | Resolution Tool |
|---|---|---|---|
| Python | pyproject.toml, requirements.txt, uv.lock | uv, pip | uv pip compile |
| Node.js | package.json, package-lock.json, yarn.lock | npm, yarn, pnpm | npm view, npm ls |
pyproject.toml (preferred - modern Python)requirements.txt (legacy)uv.lock, poetry.lock, requirements.lock# Detection order
if [[ -f "pyproject.toml" ]]; then
# Use pyproject.toml as source of truth
elif [[ -f "requirements.txt" ]]; then
# Fall back to requirements.txt
fi
package.json (required)package-lock.json, yarn.lock, pnpm-lock.yaml# Detection
if [[ -f "package.json" ]]; then
# Node.js project detected
fi
# Step 1: Get currently installed/locked versions
uv pip freeze --format json
# Step 2: Resolve a new dependency against existing project
# Creates a temporary requirements and resolves compatible version
uv pip compile pyproject.toml \
--extra-requirement "pydantic>=2.0" \
--dry-run \
--quiet 2>&1
# Step 3: Get the resolved version for a specific package
uv pip compile - <<< "pydantic>=2.0" --dry-run 2>&1 | grep "pydantic=="
# Alternative: Check latest compatible version
uv pip compile - <<< "pydantic>=2.0,<3.0" --dry-run 2>&1
Parsing uv output:
pydantic==2.5.3)# Step 1: Get current dependency tree
npm ls --all --json 2>&1
# Step 2: Check what version would be installed
npm view zod@">=3.0" version --json
# Step 3: Check for peer dependency conflicts
npm install zod@">=3.0" --dry-run --json 2>&1
# Step 4: Explain dependency resolution
npm explain zod
Parsing npm output:
npm view outputERESOLVE errors for peer dependency issuesWhen a requested version range can be satisfied:
Requested: pydantic>=2.0
Resolved: pydantic==2.5.3
When new requirement needs a higher version than currently installed:
upgrade list with pinned versionCurrent: requests==2.25.1
Requested: requests>=2.28
Resolved: requests==2.31.0 (in upgrade list)
When direct version causes conflict:
Existing: sqlalchemy>=1.4,<2.0 (from another package)
Requested: sqlalchemy>=2.0
Conflict: No compatible version
Action: Error with explanation, requires manual resolution
Dependencies are output as pinned version strings:
{
"dependencies": {
"python": {
"add": ["pydantic==2.5.3", "sqlalchemy==2.0.25", "httpx==0.27.0"],
"upgrade": ["requests==2.31.0"],
"remove": [],
"add_dev": ["pytest==7.4.3", "pytest-asyncio==0.21.1", "mypy==1.8.0"]
}
}
}
{
"dependencies": {
"node": {
"add": ["zod@3.22.4", "express@4.18.2", "@types/node@20.10.0"],
"upgrade": ["axios@1.6.2"],
"remove": [],
"add_dev": ["typescript@5.3.3", "vitest@1.2.0", "eslint@8.56.0"]
}
}
}
Format conventions:
package==version (PEP 440)package@version (npm convention)After extracting dependencies from Tech Spec imports (Step 7), invoke this skill:
7b. Align dependency versions (invoke `dependency-alignment` skill):
- Detect project ecosystem (Python/Node.js)
- For each extracted dependency:
a. Query resolution tool for compatible version
b. Check against existing project dependencies
c. Resolve conflicts automatically
- Output pinned versions for manifest.json
Tech Spec imports → Extract packages → Resolve versions → Pinned manifest
Example:
from pydantic import BaseModel → pydantic (no version)
from sqlalchemy import ... → sqlalchemy (no version)
↓
uv pip compile --dry-run → pydantic==2.5.3
sqlalchemy==2.0.25
↓
manifest.json → "add": ["pydantic==2.5.3", "sqlalchemy==2.0.25"]
When no compatible version exists:
ERROR: Cannot resolve dependency conflict
Package: sqlalchemy
Requested: >=2.0 (from Tech Spec)
Existing: <2.0 (required by flask-sqlalchemy==2.5.1)
Resolution options:
1. Upgrade flask-sqlalchemy to >=3.0 (supports SQLAlchemy 2.x)
2. Modify Tech Spec to use SQLAlchemy 1.4 API
3. Remove flask-sqlalchemy and use SQLAlchemy directly
Action required: Manual resolution before proceeding
When resolution tools are unavailable:
WARNING: uv not available, falling back to version ranges
Dependencies will use version specifiers instead of pinned versions:
"add": ["pydantic>=2.0", "sqlalchemy>=2.0"]
Run with uv installed for reproducible pinned versions.