dependency-upgrade

Audit, update, and verify project dependencies one at a time with rollback planning.

Updated Apr 13, 2026
One-click install
npx skills add https://github.com/scoots31/engineering-playbook --skill dependency-upgrade-scoots31
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: dependency-upgrade
Source: https://github.com/scoots31/engineering-playbook/tree/main/skills/dependency-upgrade
Command: npx skills add https://github.com/scoots31/engineering-playbook --skill dependency-upgrade-scoots31

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Outdated dependencies accumulate security vulnerabilities and breaking-change risk, and upgrading everything at once makes failures impossible to isolate. This Skill provides a disciplined, step-by-step process for upgrading packages safely without breaking a running system. ## Core Features & Use Cases - Prioritized Audit: Inventories outdated packages using stack-appropriate tools (npm audit, pip list --outdated, bundle outdated) and ranks them by security flags, major, and minor/patch severity. - Breaking Change Review: Requires reading changelogs and migration guides before any major version upgrade to catch API, config, and peer dependency changes. - Isolated Updates with Verification: Updates one dependency at a time with per-update commits, smoke tests, production verification, and a known rollback path. - Use Case: A security scan flags a vulnerable npm package in production. Use this Skill to audit all outdated dependencies, upgrade the flagged package first, verify the app still passes its critical paths, and deploy during a low-traffic window with a lockfile rollback plan. ## Quick Start Audit my project's outdated dependencies and walk me through upgrading them safely one at a time.

Frequently Asked Questions about dependency-upgrade

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I safely upgrade outdated npm or pip dependencies?

Audit outdated packages first with tools like npm audit or pip list --outdated, then upgrade one dependency at a time. After each update, verify the app starts, run existing tests, and commit individually so any breakage is isolated to a single change.

How to check for breaking changes before a major version upgrade?

Read the package's changelog and migration guide before upgrading any major version. Look for API changes affecting your codebase, required config changes, and peer dependency requirements that could conflict with your current stack.

Should security-flagged packages be upgraded first?

Yes, security-flagged packages always go first regardless of upgrade complexity. Deferring them leaves a known vulnerability in production, which outweighs the risk of a carefully tested upgrade.

Why not upgrade all dependencies in one commit?

Batching all upgrades makes it impossible to isolate which package caused a failure. Updating one at a time with separate commits means you know exactly what broke and can revert a single change instead of the entire batch.

What should I do before deploying dependency updates to production?

Run a full smoke test of critical paths, resolve any peer dependency warnings, and know your rollback path such as reverting to the previous lockfile. Deploy during low-traffic periods and verify the application runs correctly in production afterward.