What problem does it solve? Upgrading dependencies is risky: hidden outdated packages, retired audit endpoints, peer dependency conflicts, and silent pins can break builds or leave security holes. This Skill provides a disciplined, package-manager-agnostic workflow that assesses before acting and verifies every green signal end to end. ## Core Features & Use Cases - Full-scope assessment: Detects the package manager from the lockfile, reads the complete outdated report, verifies the vulnerability audit channel actually works, and inspects registry metadata for ceilings before installing anything. - Risk-based triage and planning: Separates security fixes, patches, minors, and majors into dedicated PRs or batches, identifies interdependent cohorts that must upgrade atomically, and plans every pin with a recorded rationale plus an update-tooling cap. - Verified execution: Distinguishes genuine peer incompatibilities from ecosystem lag, runs codemods before manual edits, forces clean non-cached quality-gate runs, and checks root-to-workspace version alignment in monorepos. - Use Case: A maintainer of a pnpm monorepo needs to bump ESLint to a new major. The Skill walks them through reading the migration guide, upgrading the linter and its plugins as one cohort commit, curating new recommended rules one by one, and confirming no workspace is left on the old version. ## Quick Start Ask the agent to upgrade all outdated dependencies in this repository, triaging security fixes separately and verifying the full build, test, and lint gate after each change.
