Compare Dependencies

code.compare_dependencies

ProductionBounded custom (Class B)Deterministicverifiablefastv1.0.0

No network

Overview

When you have two manifest snapshots — for example before and after a PR — we extract dependencies from each side and report added, removed, changed, upgraded, downgraded, and scope-changed entries. Upgrade/downgrade direction is reliable for SemVer-style versions; other schemes fall back to lexical comparison. We do not install packages, run builds, or resolve ranges against a registry — do not use this for vulnerability scanning or authoritative resolution.

Raw manifest diffs are noisy. We turn them into a structured dependency drift report you can gate on in review.

Reliability

Deterministic once dependencies are extracted; stable ordering. Upgrade and downgrade direction is authoritative for SemVer versions; otherwise lexical. Invalid side shapes throw validation errors — fix the input before retrying.

Context footprint

Returns a summary object plus a sorted changes array and warnings. A successful call costs 1 execution credit.

When to use it

When you already extracted or can supply both manifest snapshots and need a drift summary.

For vulnerability scanning, builds, or registry resolution.

Scope

Note

Compares two dependency manifests and classifies drift between them.

Non-goals

Does not install packages
Does not query vulnerability databases
Does not run builds
Does not resolve version ranges against a registry
Upgrade/downgrade on non-SemVer versions is best-effort lexical

Properties

IdempotentRetry safeStreaming supportedFile input supportedRequires external service

Capabilities

analysisparsing

Cost & billing

Flat rate per invocation

MetercallsBillable onsuccessCost per call1 credit

File handling

Accepts file_refProduces file_refMax input2 MB

How we handle your data

Sensitive input, safe output

What this means

This skill may receive sensitive content, but it does not target sensitive data and returns only a structured non-sensitive result.

Squillify guarantees

Runs inside Squillify
This skill runs inside Squillify.
Payloads are not sent to an external service by this skill.
Squillify does not permanently store submitted payloads.
Telemetry records metadata only, not submitted content.
Submitted payloads are not used for training.
Submitted payloads are not reviewed by humans.
This skill does not target sensitive data.
The response does not contain submitted content.

Your responsibility

Squillify does not determine whether submitted content is sensitive. Your application is responsible for deciding what data it is allowed to submit. Your application is responsible for securing the response.

Read the Microskill Data Handling Policy

Input schema

Field	Type	Required	Description
left	object	Yes	Closed dependency-manifest snapshot with 0 through 200 filename-and-content file objects.
right	object	Yes	Closed dependency-manifest snapshot with 0 through 200 filename-and-content file objects.
ecosystemHint	string	No	Inert ecosystem hint; omit it because filenames select parsers.
includeDevDependencies	boolean	No	Whether development scopes are included; omit it for true.
versionCompare	string	No	Version-direction policy; omit it for semver.

Output schema

Field	Type	Required	Description
summary	object	Yes	Closed counts containing added, removed, changed, upgraded, and downgraded properties.
changes	array	Yes	From 0 through 100,000 changed dependencies in stable order.
warnings	array	Yes	From 0 through 400 parsing warnings, at most one per supplied file.

API contract

POST /v1/execute

curl

curl -sS -X POST "$BASE/v1/execute" -H "Authorization: Bearer $KEY" -H 'Content-Type: application/json' -d '{"skillKey":"code.compare_dependencies","input":{"left":{"files":[{"filename":"package.json","content":"{}"}]},"right":{"files":[]}}}'

Integrations

TypeScript SDK

import { Squillify } from "@squillify/sdk";

const sq = new Squillify({ apiKey: process.env.SQUILLIFY_API_KEY });

const { output } = await sq.execute("code.compare_dependencies", {"left":{"files":[{"filename":"package.json","content":"{\"dependencies\":{\"react\":\"18.2.0\"}}"}]},"right":{"files":[{"filename":"package.json","content":"{\"dependencies\":{\"react\":\"18.3.1\"}}"}]}});

Errors

Code	HTTP	Retryable	Description
VALIDATION_ERROR	400	No	The request payload failed schema validation.
UNAUTHORIZED	401	No	Missing or invalid API key.
SKILL_NOT_ACCESSIBLE	403	No	The API key is not granted access to this skill.
SKILL_NOT_AVAILABLE_FOR_PLAN	403	No	This skill is not included in your current plan.
PLAN_ELIGIBILITY_UNAVAILABLE	503	Yes	Plan eligibility could not be decided. Retry after backoff.
SKILL_NOT_FOUND	404	No	The requested skill or version does not exist.
TENANT_RATE_LIMITED	429	Yes	Request rate limit exceeded. Retry after backoff.
QUOTA_EXCEEDED	429	Yes	Plan quota exhausted. Retryable once the quota period resets.
EXECUTION_TIMEOUT	504	Yes	Execution exceeded the allowed time budget.

Other limits

Limit	Value
Recommended inline bytes	32 KiB

Limitations

Does not install packages
Does not query vulnerability databases
Does not run builds
Does not resolve version ranges against a registry
Upgrade/downgrade on non-SemVer versions is best-effort lexical
Vulnerability scanning
Registry-backed transitive resolution

How to call

POST /v1/execute (requires authentication)

Request bodyjson

{
  "skillKey": "code.compare_dependencies",
  "input": {
    "left": {
      "files": [
        {
          "filename": "package.json",
          "content": "{\"dependencies\":{\"react\":\"18.2.0\"}}"
        }
      ]
    },
    "right": {
      "files": [
        {
          "filename": "package.json",
          "content": "{\"dependencies\":{\"react\":\"18.3.1\"}}"
        }
      ]
    }
  }
}

Examples

Patch-level npm upgrade on one dependency

Inputjson

{
  "left": {
    "files": [
      {
        "filename": "package.json",
        "content": "{\"dependencies\":{\"react\":\"18.2.0\"}}"
      }
    ]
  },
  "right": {
    "files": [
      {
        "filename": "package.json",
        "content": "{\"dependencies\":{\"react\":\"18.3.1\"}}"
      }
    ]
  }
}

Expected outputjson

{
  "warnings": [],
  "summary": {
    "upgraded": 1,
    "downgraded": 0,
    "added": 0,
    "changed": 1,
    "removed": 0
  },
  "changes": [
    {
      "manager": "npm",
      "changeType": "changed",
      "rightVersion": "18.3.1",
      "name": "react",
      "versionDirection": "upgraded",
      "leftVersion": "18.2.0"
    }
  ]
}

Identical manifests produce an empty diff