What problem does it solve? Updating dependencies in a polyglot repository is risky: changelogs go unread, transitive bumps slip in, security alerts live in channels no outdated-command covers, and a green CI suite can mask a breaking change. This Skill provides an executable playbook that forces per-dependency research, classification, and domain-appropriate validation before any bump is merged. ## Core Features & Use Cases - Per-domain inventory and validation recipes: Covers Ruby gems, Ruby itself, bundler, CI workflow actions, JS/importmap vendored assets, conda ML and in-silico environments, firmware C submodules, Terraform providers, .NET NuGet pins, Solidity/Foundry contracts, the subgraph npm toolchain, and Docker runtime images. - Structured core loop: Read open Dependabot security alerts first, inventory what is outdated, research the exact version's changelog, classify as security/breaking/behavior/routine, validate with the domain's gate, and capture the research in the commit body. - 46 hard-won gotchas: An indexed companion file (gotchas.md) documents real incidents such as release-age quarantine, transitive caps, masked breaking passengers, and stale green checks. - Use Case: Run a full dependency sweep before a release: check open security alerts, run bundle outdated and per-domain inventory commands, research each candidate version, apply the release-age quarantine, validate with the domain's test gate, and commit each bump with its research in the commit body. ## Quick Start Ask the assistant to run the dependency sweep and update the outdated gems, researching each changelog and validating with the full test suite before committing.
