skills.rest
paywhereb
paywherebOFFICIAL
Explore all skills by this author →
GitHub

safe-deps

Classify outdated npm packages as SAFE or RISKY from lockfile semver deltas.

Updated May 20, 2026
Search Tags:#npm#security audit#peer dependencies#pull request automation#dependency update#semver analysis#Linear tickets
One-click install
npx skills add https://github.com/paywhereb/paywhere-claude-plugins --skill safe-deps
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: safe-deps
Source: https://github.com/paywhereb/paywhere-claude-plugins/tree/main/paywhere-eng-workflow/skills/safe-deps
Command: npx skills add https://github.com/paywhereb/paywhere-claude-plugins --skill safe-deps

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

safe-deps removes the guesswork of upgrading npm dependencies by automatically recomputing what is safe to bump versus what needs human triage.

Core Features & Use Cases

  • Curated refresh: Enumerates all outdated npm packages from the current lockfile and classifies each update as SAFE or RISKY using deterministic semver rules.
  • One SAFE PR bundle: Applies all SAFE upgrades in a single branch and creates a single pull request for fast, shippable improvements.
  • Actionable RISKY triage report: Groups risky upgrades by peer-dependency compatibility and produces a structured report with recommendations (do alone, do as group, or skip this cycle).
  • Guardrails and repo checks: Enforces a clean working tree, repo-default-branch constraints, audit/build/test gates, and an optional per-repo guard hook from .claude/eng-workflow.json.

Quick Start

Run the safe-deps skill to create a SAFE refresh PR and get a grouped RISKY report for manual review.

Frequently Asked Questions about safe-deps

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I safely update npm dependencies without breaking peer dependencies?▼

Updating npm dependencies safely requires classifying outdated packages as SAFE or RISKY using deterministic semver rules from the current lockfile, then grouping risky bumps by peer-dependency compatibility for manual triage.

What is the best way to automate npm dependency updates and pull request creation?▼

The best way to automate npm dependency updates is to bundle all SAFE semver upgrades into a single branch, run audit and build/test gates, and create one pull request while generating a separate RISKY triage report.

How does semver analysis determine if a dependency upgrade is risky?▼

Semver analysis determines upgrade risk by comparing lockfile and registry semver deltas, classifying updates as SAFE if they pass deterministic rules, and flagging RISKY bumps that violate peer-dependency compatibility constraints.

Do I need a clean working tree to run a dependency security audit and update?▼

Yes, a dependency security audit and update requires a clean working tree and repo-default-branch constraints, enforcing these guards before running audit and build/test gates to ensure deterministic dependency rollups.

Can I create Linear tickets for risky npm dependency upgrades?▼

Yes, you can create Linear tickets for risky npm dependency upgrades by grouping peer-dependency compatibility issues into a triage report and generating a pressing-to-schedule assessment for manual review.

Why does my npm dependency update fail the build and test gate?▼

An npm dependency update fails the build and test gate because the skill enforces audit, build, and test gates for SAFE changes, preventing unsafe dependency rollups from proceeding to pull request creation.

Related Skills

Explore More Software Engineering Skills→
paywherebpaywhereb

tc-reconcile

Reconciles TeamCity UI-generated .kts patches into settings.kts DSL files and validates with mvn teamcity-configs:generate.

Official
Advanced
bl1nk-botbl1nk-bot
3

linear

Manage Linear issues and projects via the Linear MCP server.

Official
Advanced
grandameniumgrandamenium
88

framework-upstream-auto-update

Fetch upstream/main, classify commits, and apply safe bugfix/docs/chore changes with verification.

Community
Advanced
zinohomezinohome
1

dependency-doctor

Audit project dependencies for outdated packages, duplicates, and security vulnerabilities.

Community
Intermediate