What problem does it solve? Version bumps often hide breaking changes, silent default shifts, and supply-chain risks that a simple lockfile edit never surfaces. This Skill turns every dependency upgrade into a structured migration audit so nothing changes in NemoClaw without evidence of what changed upstream and where it is consumed downstream. ## Core Features & Use Cases - Release-by-release ledger: Enumerates every adjacent release range in the upgrade gap and audits release notes, commits, source diffs, and upstream tests per range instead of collapsing them into one diff. - Contract tracing and concern ledger: Maps changed upstream contracts (CLI, config, API, lifecycle, packaging) to direct and indirect NemoClaw consumers, then records each risk in a structured concern ledger with severity, disposition, and verification evidence. - Deterministic evidence collection: Ships a hardened Python collector that gathers Git and GitHub release evidence with frozen executable identities, bounded subprocesses, and integrity-checked non-promisor clones. - Use Case: When upgrading OpenShell or OpenClaw across multiple tags, run the audit to produce a per-range ledger, implement migrations in release order, and hand off a reviewable PR with resolved concerns and remaining external gates. ## Quick Start Use the nemoclaw-contributor-update-dependencies skill to audit and implement the upgrade of OpenShell from the current pinned version to the latest release.
