skills.rest
oliver-kriska
oliver-kriskaCOMMUNITY
Explore all skills by this author →
Website𝕏@quatermain32GitHub

phx-deps-update

Update Hex dependencies in Elixir projects with changelog deltas, verification, and grouped PRs.

537|38|Updated Feb 12, 2026
Search Tags:#hex#Elixir#Phoenix#mix.exs#dependency update#Pull request#ChangeLog
One-click install
npx skills add https://github.com/oliver-kriska/claude-elixir-phoenix --skill phx-deps-update
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: phx-deps-update
Source: https://github.com/oliver-kriska/claude-elixir-phoenix/tree/main/targets/codex/skills/phx-deps-update
Command: npx skills add https://github.com/oliver-kriska/claude-elixir-phoenix --skill phx-deps-update

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Upgrading Hex dependencies in Elixir/Phoenix projects is risky: major versions hide breaking changes, coupled packages like Phoenix and Ecto break when bumped separately, and a lockfile change without verification can silently corrupt a build. This Skill runs a disciplined inventory → update → fix → PR workflow that catches those failures before they ship.

Core Features & Use Cases

  • Classified Inventory: Parses mix hex.outdated output into patch/minor/major/blocked groups, including git deps, private orgs, and umbrella apps.
  • Changelog-Driven Updates: Snapshots changelogs before updating and extracts deltas via mix hex.package diff with GitHub releases fallbacks, so no update happens blind.
  • Coupled-Group Handling: Forces Phoenix, Ecto, Ash, Oban, telemetry, and other interdependent package families into single atomic commits, including assets/package-lock.json for Phoenix bumps.
  • Verification & Security Handoff: Gates every update on compile-plus-test verification and hands the lock diff to a security audit before creating grouped PRs.
  • Use Case: Run $elixir-phoenix:phx-deps-update --scope patch to bundle all low-risk patch bumps into one verified PR, or target a single package like phoenix_live_view with its coupled group.

Quick Start

Ask the assistant to update the outdated Hex dependencies in your mix.exs project, starting with a dry-run inventory of what can be bumped.

Frequently Asked Questions about phx-deps-update

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I safely update Hex dependencies in an Elixir project?▼

Run an inventory with mix hex.outdated, classify updates by semver delta, then update per package while snapshotting changelogs first. Verify each change with compile --warnings-as-errors plus the test suite before committing mix.lock and mix.exs together.

How do I upgrade a Phoenix dependency across a major version?▼

Edit the version constraint in mix.exs first, since mix deps.update cannot cross a requirement boundary. Use mix hex.outdated <pkg> to check whether transitive consumers block the new major, adding override: true only when one does, and keep one major per PR.

Why does mix hex.outdated exit with code 1?▼

Exit code 1 from mix hex.outdated is normal and simply means some dependencies are outdated, not that the command failed. Capture its output with || true and parse the text table, since no JSON output exists.

Which Elixir packages must be updated together?▼

Coupled groups include Phoenix core (phoenix, phoenix_live_view, phoenix_ecto), Ecto with ecto_sql and postgrex, Ash libraries, Oban with oban_pro and oban_web, and telemetry packages. Bumping one member without its siblings causes compile or runtime errors from version pinning.

Can I preview dependency updates without changing mix.lock?▼

Yes, use the --dry-run flag to stop after the inventory phase. It produces a classified table of patch, minor, major, blocked, and git dependencies without editing mix.exs or mix.lock.

How do I get a changelog diff between two Hex package versions?▼

Run mix hex.package diff <pkg> <old>..<new>, which fetches both tarballs and diffs them, keeping the CHANGELOG.md hunk. If no changelog exists, fall back to GitHub releases via gh api or link the diff.hex.pm compare URL.

Related Skills

Explore More Software Engineering Skills→
mcauduro0mcauduro0
1

Dependency Auditor

Audit software dependencies for CVEs and license compliance across JavaScript, Python, Go, Rust, and Ruby.

Community
Advanced
concept2cureconcept2cure

ship

Automate the ship workflow from branch merge to pull request creation.

Community
Advanced
bugrabilgebugrabilge
10

build-fix

Diagnose and resolve build errors in JavaScript, TypeScript, and Python.

Community
Intermediate
lklimeklklimek
1

dependabot-merge

Audit and conditionally merge Dependabot pull requests based on CI status.

Community
Advanced