Update npm dependencies one package at a time with mandatory audits.
npx skills add https://github.com/mdproctor/cc-praxis --skill npm-dependency-update
Please help me install this Agent Skill. Skill: npm-dependency-update Source: https://github.com/mdproctor/cc-praxis/tree/main/npm-dependency-update Command: npx skills add https://github.com/mdproctor/cc-praxis --skill npm-dependency-update
Keeping npm dependencies up to date and secure is error-prone when updates are applied in bulk; this Skill enforces safe, deterministic updates with explicit user consent and ongoing security audits.
Begin by reviewing your manifest, running an audit, and proposing changes one package at a time before applying them.
High-intent search queries and answers about installing and using this skill.
To update npm dependencies safely, enforce one-package-at-a-time updates and run npm audit after every change. This process checks change logs for breaking changes and requires explicit user confirmation before applying any package version bumps.
Run an npm security audit after every single-package update and address high-severity findings first. This audit-driven approach maintains lockfile integrity while ensuring explicit user confirmation before modifying dependencies or devDependencies.
Yes, this dependency update process works with yarn and pnpm projects. It enforces correct dependencies and devDependencies separation while preserving lockfile integrity across npm, yarn, and pnpm package managers.
Pin exact versions for production dependencies while preserving appropriate ranges for dev dependencies by enforcing cross-package discipline. This ensures deterministic updates and maintains proper lockfile management during version bumps.
Updating npm packages one at a time minimizes the risk of breaking changes compared to bulk updates. This deterministic approach enforces mandatory audit checks and explicit user confirmation before applying any version bump to your manifest.
The limitation of a one-package-at-a-time npm update workflow is that it requires explicit user confirmation for every change, making bulk upgrades slower. However, it prioritizes security audits and lockfile integrity over speed to prevent breaking changes.
rsmdtDetect framework, language, and package manager from codebase files.
jellyrockStandardize major dependency bump reviews for JellyRock Roku applications.
jd-opensourceAudit dependencies, CI/CD pipelines, and build artifacts for supply chain risks.
p-o-ke-naePlan staged dependency upgrades with compatibility analysis and rollback paths.
