bump-dependencies skillA
bump-dependencies is agent-read markdown (skill) from pisberg/vibetags: Bump every third-party dependency, plugin and toolchain pin in VibeTags to its latest stable release, mirror the pins Gradle cannot inherit, verify with the real gates, and open the PR. Use when the user says "bump dependencies", "update dependencies", "dependency update", "upgrade deps", "are we on the latest versions", or before a release..
Indexed from public GitHub and served as immutable, content-addressed versions. Install it pinned to an exact SHA-256 with the mdr CLI, and every file is verified against the hash recorded here before it reaches your agent. The deterministic audit below grades the latest version, and the same file always earns the same grade.
What the file says
# Bump dependencies Every third-party version lives once, as a `<name.version>` property in `vibetags-parent/pom.xml`; the managed poms inherit it and `BuildVersionParityTest` fails the build if a literal creeps back in or a Gradle coordinate drifts. What that test cannot see is whether the pinned version is *current*, which is what this skill is for. ## Step 1 - Branch, then report ```bash git fetch origin && git checkout -b chore/bump-dependencies-$(date +%F) origin/main tools/bump-dependencies.sh # read-only; add --include-prereleases to see betas ``` The script prints one line per property with its Maven Central latest, then the toolchains pinned outside the parent (Gradle wrapper, Kotlin, Groovy, Scala 2.13). It exits 2 if the parent gains a `*.version` property the script has no Maven Central path for: add the path to its `PINS` table in the same change, so the report can never silently go stale. ## Step 2 - Decide - Apply stable releases only. Never an alpha, beta, milestone (`M1`), RC or `-ea`, even when Maven Central marks it `<latest>`; the report already hides them by default. …
Read the whole file at its exact version.
How to install
mdr add pisberg/vibetags/bump-dependencies@git:20260919.0d98a54mdr add pisberg/vibetags/bump-dependencies@sha256:18ddde08317a9419Pin to a label to follow the author's releases, or to a sha256 to freeze the exact bytes forever. Either way the resolved hash is written to mdr.lock, and mdr install reproduces it on any machine.
[](https://markdownregistry.com/a/art_6klmgcwkwy7m556m)
0 badge views in 30 days
Versions
| version | committed | commit | size | audit | |
|---|---|---|---|---|---|
| git:20260919.0d98a54 latest | 2026-09-19 | 0d98a54 | 5,794 B | A | view · diff |
| git:20260830.44c9c96 | 2026-08-30 | 44c9c96 | 5,180 B | A | view · diff |
| git:20260825.5c2f060 | 2026-08-25 | 5c2f060 | 5,184 B | A | view · diff |
| git:20260820.1cddfe2 | 2026-08-20 | 1cddfe2 | 5,021 B | A | view · diff |
| git:20260816.92df68f | 2026-08-16 | 92df68f | 4,993 B | A | view |
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (5794 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
pisberg/vibetags · 25 stars · license MIT · pushed 2026-09-25 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_6klmgcwkwy7m556m GET https://markdownregistry.com/api/v1/resolve?ref=pisberg/vibetags/bump-dependencies GET https://markdownregistry.com/api/v1/blob/18ddde08317a94198ffcd8e074e6f9424de5d03e0b71ed6cb17afddede8af54f
Your agent does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.