What problem does it solve? Upgrading package dependencies is risky: unverified sources, breaking transitive changes, license shifts, and failed builds can slip through without a disciplined process. This Skill enforces a provenance-aware, minimal-change upgrade workflow with evidence at every step. ## Core Features & Use Cases - Provenance and Advisory Verification: Confirms package identity, integrity, release notes, security advisories, and license impact before applying any update. - Minimal, Reproducible Updates: Applies the smallest supported change using the repository's locked package manager, keeping manifests and lockfiles in agreement. - Approval Gates and Rollback: Requires explicit approval for major upgrades, new registries, lifecycle scripts, or license changes, and restores prior state on failure. - Use Case: A security advisory affects a direct dependency. Use this Skill to verify the patched version's provenance, apply the update, run focused tests and security checks, and produce a report documenting the advisory resolution and rollback instructions. ## Quick Start Use the dependency-maintenance skill to update the vulnerable lodash dependency to the latest patched version and verify the lockfile and tests.
