dependency-upgrade
Skill0 starsChanged 4 months agoMITView on GitHub
Upgrade dependencies safely: read changelogs, classify breaking changes, stage bumps, and gate on tests. Use when updating packages, resolving security advisories (npm audit, dependabot), upgrading a framework or runtime version, or unpinning stale dependencies. Do not use for adding a brand-new dependency (that's a design choice — consider architecture).
23 other projects use a version of this.
Adopted by
Most recently taken up by
- paureis/pau-skillstheir own version, first seen Nov 8, 2026
- HyperVon/agent-guidance-kittheir own version, first seen Nov 1, 2026
- navikt/copilottheir own version, first seen Nov 1, 2026
- agentkitco/agentkit-dev-skillstheir own version, first seen Nov 1, 2026
- Eliahhango/nullbyte-securitytheir own version, first seen Nov 1, 2026
- itsofficialadi/boundifftheir own version, first seen Oct 25, 2026
Other versions23 projects use a version of this.
Word for word · 0
None found.
Edited · 0
None found.
Wrote their own version · 23
- secondsky/sap-skills★ 462same name
- navikt/copilot★ 61same name
- xfstudio/skills★ 9same name
- KhaledSaeed18/dotclaude★ 5same name
- Eliahhango/nullbyte-security★ 4same name
- juanitourquiza/shipframe★ 4same name
- WST2002/claude-code-skills★ 4same name
- 0disoft/mcp-security-proxy★ 2same name
- ai4brands-design/claude-skills★ 2same name
- CodeWithBehnam/cc-docs★ 2same name
13 more not listed
How matches are found. Word for word: the exact same text. Edited: shares passages with this file (“99% same” means 99% of its five-word phrases also appear here; 10% or more counts). Their own version: similar meaning, or, weakest, the same name. We can’t tell which project had it first. Projects are counted among the 200 most-starred candidates, and mentions are links to the repository we found, up to 50 per site, so both counts are a floor.
In this repository40 other files it gives its agents.
- address-pr-feedbackSkill
- architectureSkill
- code-reviewSkill
- code-structureSkill
- competitive-briefSkill
- contract-guardSkill
- debugSkill
- deep-workSkill
- deploy-checklistSkill
- diagnoseSkill
- documentationSkill
- explain-pr-step-by-stepSkill
- feedback-checkpointSkill
- grill-meSkill
- grill-with-docsSkill
- handoffSkill
- improve-codebase-architectureSkill
- incident-responseSkill
- memory-managementSkill
- observabilitySkill
- plan-criticSkill
- plan-from-rfcSkill
- pr-babysitterSkill
- prototypeSkill
- queue-checkSkill
- rebase-onto-mainSkill
- releaseSkill
- security-reviewSkill
- setup-engineering-skillsSkill
- squash-and-pushSkill
- synthesize-researchSkill
- system-designSkill
- tddSkill
- tech-debtSkill
- testing-strategySkill
- to-issuesSkill
- to-prdSkill
- triageSkill
- verification-before-completionSkill
- zoom-outSkill
The file
We split this skill into the rules it gives an agent
2 rules. 0 are common, 2 are distinctive, and 0 are very specific to this project.
0
Common
Most of the 22 edited versions we read keep these.
2
Distinctive
This author's own choices. Worth a look.
0
Very specific
Tied to their project's names, files or tools. Probably skip.
- Common
- Distinctive
- Very specific
- Distinctive: line 27
Never bulk-upgrade everything to latest in one commit "while at it".
- Distinctive: line 29
Don't suppress peer-dependency warnings with force flags.
“Common” is measured: kept by at least 6 in 10 of the 22 edited versions of this file we could read. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.
Files
Dependency Upgrade
An upgrade is someone else's breaking-change list applied to your code. Read it before you take it.
Workflow
- Inventory — what's being upgraded and why (security advisory, staleness, feature need). Current version → target version. Note whether it's a direct or transitive dependency; transitive fixes may only need a resolution/override.
- Read the release notes between the versions — actual changelogs/migration guides, all majors in the jump (
v2 → v4means reading v3's breaking list too). Extract: breaking changes, deprecations, behavior changes, new peer/runtime requirements. - Map breakage to this codebase — search for each breaking API's usage. The result is a concrete edit list, possibly empty. Unknown usage (dynamic access, config-driven) → flag it, don't assume absence.
- Stage the bumps — one major at a time; separate commits per risky package (or tight group). Security patches for unrelated packages don't ride along with a framework major.
- Gate each stage — install clean (lockfile updated intentionally), typecheck, lint, run the test suite, and exercise the feature areas the changelog flagged. For a security advisory: verify the vulnerable path is actually gone (
npm audit/ equivalent re-run). - Watch for silent behavior changes — defaults that flipped, stricter parsing, changed serialization. The taxonomy in the
contract-guardskill applies: if the upgraded dependency sits behind one of your external contracts, confirm your own surface didn't change with it. - Record — commit message lists package, version range, notable breaking changes handled, and evidence run. Update pinned-version docs if the project keeps them.
Constraints
- Never bulk-upgrade everything to latest in one commit "while at it".
- A green suite after a major bump with zero code changes deserves suspicion, not celebration — check the suite actually covers the usage.
- Don't suppress peer-dependency warnings with force flags; resolve them or defer the upgrade with a note.
- Runtime/toolchain upgrades (Node, TypeScript, database) get the same treatment plus a check of CI images and deploy targets.
Verification
- Release notes read across the full version jump
- Usage of each breaking API located (or absence confirmed)
- Bumps staged, one risky upgrade per commit
- Full gate run per stage (install, typecheck, lint, tests, flagged areas)
- Security advisories: vulnerability confirmed resolved
- Own external contracts unaffected (contract-guard check when applicable)
Does it work?
Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.
No reviews yet
People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.
- It worked
- Partly
- It didn't
Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.
Your trail
Files you open will collect here, so you can find them again.
Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.
Now do this for your own.
Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.