What problem does it solve? Upgrading dependencies blindly causes broken builds, hidden breaking changes, and exposure to compromised package versions. This Skill turns version bumps into a sequenced, evidence-backed process with changelog review, call-site analysis, verification gates, and supply-chain audits. ## Core Features & Use Cases - Changelog-Driven Planning: Pin exact versions from the lockfile, read migration guides for every intermediate major, and map breaking changes to actual call sites in your codebase via grep. - Per-Stack Execution Workflows: Step-by-step upgrade commands and verification pipelines for Composer/PHP, npm/pnpm/yarn, pip/poetry/uv, Go modules, and Cargo, with one-major-at-a-time sequencing and rollback plans. - Supply-Chain Security Audit: Detect compromised updates that CVE scanners miss by diffing install scripts, transitive dependencies, network capabilities, and provenance between old and new versions. - Use Case: A Dependabot alert forces a React upgrade from v17 to v19. Use this Skill to map the version path, identify which breaking changes touch your code, upgrade one major at a time behind green tests, and audit the new versions for malicious behavior before merging. ## Quick Start Plan and execute a safe upgrade of my project's lodash dependency to the latest version, including a security audit of the new release.
