What problem does it solve? Hand-typed version strings in dependency manifests are often outdated or wrong because they come from memory rather than the registry. This Skill ensures every dependency version is resolved from the live registry by the package manager itself, keeping manifests, lockfiles, and Dependabot configuration accurate. ## Core Features & Use Cases - Registry-Resolved Versions: Uses each package manager's add/install command (cargo add, pnpm add, uv add, go get, bundle add) so the correct current version lands in both the manifest and lockfile in one step. - Runtime and Actions Pinning: Pins Node.js to the active LTS major via nvm, and GitHub Actions to floating major version tags resolved with the gh CLI rather than commit SHAs. - Dependabot Synchronization: On GitHub-hosted repos, checks .github/dependabot.yml covers every ecosystem and directory in use, adding entries or proposing a new config with grouping and cooldown defaults. - Use Case: When asked to add a new npm package to a repository, the Skill runs pnpm add to resolve the latest version, then verifies the npm ecosystem and directory are covered in dependabot.yml. ## Quick Start Add the lodash dependency to my Node project and make sure Dependabot covers it.
