ln-32-dependency-upgrader
starsforks
How to install ln-32-dependency-upgrader?
levnikolaevich/claude-code-skills/ln-32-dependency-upgrader
$npx -y skills add levnikolaevich/claude-code-skills --skill ln-32-dependency-upgraderUpgrades dependencies across package managers with breaking-change research and rollback-safe verification. Use for dependency maintenance; not general code modernization.
SKILL.md
| 1 | # Dependency Upgrader |
| 2 | |
| 3 | **Goal:** Upgrade dependencies in small, attributable batches. Preserve manifests, lockfiles, runtime support, and product behavior; do not treat a newer version as valuable without compatibility, security, or maintenance evidence. |
| 4 | |
| 5 | **Execution contract:** Treat the ordered checkbox workflow below as this skill's Definition of Done. Work through every item in order, and mark it complete only when its action and required evidence are complete. `N/A`, skipped, unavailable, or delegated items remain incomplete. |
| 6 | Before returning, apply this skill's verdict, decision, and approval rules to every incomplete item and prepend **Checklist: X/Y complete**<br>**Incomplete: None | section/item — reason; outcome impact; exact next action**; list every incomplete item. |
| 7 | |
| 8 | ## Tool Routing |
| 9 | |
| 10 | | Need | Preferred tool | Use it when | Fallback | |
| 11 | |---|---|---|---| |
| 12 | | Package-manager detection | Manifests, lockfiles, workspace files, runtime files, and repository instructions | Always before choosing commands or update scope | Build and CI configuration | |
| 13 | | Outdated and vulnerable packages | Native package-manager outdated and audit commands | The manager and registry are available | Official registry, vendor advisory, and lockfile inspection | |
| 14 | | Breaking changes and support | Official release notes, migration guides, changelogs, advisories, and runtime support tables | Every consequential minor, major, replacement, or security update | Primary-source repository releases; otherwise mark `UNVERIFIED` | |
| 15 | | Usage and blast radius | Language server or host-native code intelligence | An updated API, type, plugin, build tool, or runtime may affect consumers | Targeted import, symbol, configuration, and script search | |
| 16 | | Safe version changes | Native package-manager commands | Updating manifests and generated lock state | Do not hand-edit lockfiles or emulate package resolution | |
| 17 | | Verification | Repository-defined install, restore, build, lint, type, test, migration, and smoke commands | Before changes and after each batch | CI and script inspection with explicit unverified status | |
| 18 | | Diff and rollback | Git status, diff, and isolated commits or worktree | Protecting user changes and reverting only the failed batch | Stop if the batch cannot be isolated safely | |
| 19 | |
| 20 | Never publish packages, rotate credentials, deploy, or weaken audit and verification gates. Do not run lifecycle scripts from an untrusted package source without the environment's normal safeguards. |
| 21 | |
| 22 | ## Evidence Rules |
| 23 | |
| 24 | - Manifests and lockfiles define what is installed; registry "latest" does not override project runtime or compatibility constraints. |
| 25 | - A vulnerability finding requires the affected version, advisory, reachability or exposure context, and a credible remediation. |
| 26 | - A breaking-change claim requires release or migration evidence matching the exact version transition. |
| 27 | - Keep generated lockfile changes only when produced by the selected native package manager and expected repository version. |
| 28 | - Upgrade success requires repository verification, not only a successful install or restore. |
| 29 | |
| 30 | ## Checklist |
| 31 | |
| 32 | ### 1. Discover Scope and Protect the Workspace |
| 33 | |
| 34 | - [ ] Detect all package managers, workspaces, manifests, lockfiles, central version files, registries, runtime pins, tool manifests, and generated dependency files. |
| 35 | - [ ] Classify each deliverable as an application, library, plugin, CLI, container, or build tool so version ranges, lockfiles, peer constraints, and supported-runtime promises are interpreted correctly. |
| 36 | - [ ] Read repository instructions and determine supported package-manager versions, update commands, lockfile policy, and CI expectations. |
| 37 | - [ ] Inspect Git state and isolate the work so existing user changes cannot be overwritten or mistaken for upgrade output. |
| 38 | - [ ] Start a run-owned resource ledger with every created absolute path, worktree, process ID, cache, report, and temporary artifact; never register pre-existing resources as cleanup targets. |
| 39 | - [ ] Resolve the requested scope: security-only, routine patch or minor maintenance, selected packages, majors, runtime migration, or complete refresh. |
| 40 | - [ ] Capture install or restore, build, lint, type, test, smoke, and security-audit baseline before editing. |
| 41 | - [ ] Record pre-existing failures, advisories, deprecations, peer conflicts, and unsupported runtime combinations. |
| 42 | |
| 43 | ### 2. Research and Plan Batches |
| 44 | |
| 45 | - [ ] Use native outdated and audit commands to inventory direct and relevant transitive updates without changing files. |
| 46 | - [ ] Separate removals, security fixes, routine updates, major changes, build-tool changes, and runtime or ecosystem migrations. |
| 47 | - [ ] Check official release notes and migration guides for API changes, configuration changes, defaults, peer constr |
People who liked this also viewed
6 picksType
- hyperframes-cliUse the HyperFrames CLI development loop: init, add, catalog, capture, lint, check, snapshot, compare, grade-compare, preview, play, present, beats, keyframes, single or batch render, publish, cloud, SkillsJul 2026
- request-refactor-planSkills for Real Engineers. Straight from my .agents directory.SkillsJul 2026
- analyze-projectRigor Analyze / Rigor Audit read-only skill for deep learning research repositories. Use when the user wants to read and understand a repository, inspect model structure and training or inference entrSkillsMay 2026
- explore-codeRigor Improve implementation leaf skill for auditable candidate implementation in deep learning research repositories. Use when the researcher explicitly authorizes exploratory work on an isolated braSkillsMay 2026
- ubiquitous-languageSkills for Real Engineers. Straight from my .agents directory.SkillsJul 2026
- scaffold-exercisesSkills for Real Engineers. Straight from my .agents directory.SkillsJul 2026
