dependency-upgrade is agent-read markdown (skill) from khaledsaeed18/dotclaude: Upgrade dependencies without breaking the project: audit what is outdated and why it matters (security, EOL, features), read the changelogs and migration guides for each major, upgrade in ordered small batches with the test suite and typecheck run after each, apply codemods where they exist, handle lockfile and peer-dependency conflicts, and leave a record of what changed and what was deferred. Use when a security advisory lands, when a runtime or framework reaches end of life, when a dependabot.
Indexed from public GitHub and served as immutable, content-addressed versions. Install it pinned to an exact SHA-256 with the mdr CLI, and every file is verified against the hash recorded here before it reaches your agent. The deterministic audit below grades the latest version, and the same file always earns the same grade.
What the file says
Upgrades fail when they are done all at once and diagnosed all at once. The discipline is: know what changed, change one thing, run the tests, commit, repeat. A day of small green steps beats a week of bisecting a red branch.
## Step 1: inventory
- `npm outdated` / `pnpm outdated` / `pip list --outdated` / `cargo outdated` / `go list -m -u all`, plus the audit: `npm audit`, `pip-audit`, `cargo audit`, `govulncheck`.
- For each candidate: current, latest, is it a major bump, does an advisory apply, is the current version EOL, does it block another upgrade (e.g. the test runner must move before the framework can).
- Classify: **security** (do first, minimal version that fixes), **blocking** (needed for another upgrade), **major** (needs reading), **minor/patch** (batchable).
Write the plan as a table before touching anything; get agreement if the list is long or a major touches the framework.
## Step 2: prepare
- Green baseline: full test suite, typecheck, lint, and build pass on the current commit; record timings.
- A branch per major upgrade; one branch for the minor/patch batch.
…
Pin to a label to follow the author's releases, or to a sha256 to freeze the exact bytes forever. Either way the resolved hash is written to mdr.lock, and mdr install reproduces it on any machine.
GET https://markdownregistry.com/api/v1/artifacts/art_qqq3dajiou5trofd
GET https://markdownregistry.com/api/v1/resolve?ref=khaledsaeed18/dotclaude/dependency-upgrade
GET https://markdownregistry.com/api/v1/blob/55d204e71cee5bf8923040db575d05f4a6f6ded901f29c0e39b07d65bc9a07c4
Your agent does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
khaledsaeed18/dotclaude · .agents/skills/improve/SKILL.md · Survey any codebase as a senior advisor and produce prioritized, self-contained implementation plans for OTHER…
khaledsaeed18/dotclaude · .claude-plugin/plugins/docs/skills/adr-writing/SKILL.md · Write Architecture Decision Records that a future engineer can act on: a numbered, immutable record with the context…
khaledsaeed18/dotclaude · .claude-plugin/plugins/docs/skills/openapi-spec/SKILL.md · Write, generate, or review an OpenAPI 3.1 specification for an HTTP API so that it is accurate to the implementation…
khaledsaeed18/dotclaude · .claude-plugin/plugins/docs/skills/readme-writing/SKILL.md · Write or restructure a README that gets a reader from landing to first success in minutes: a one-line purpose, a…
khaledsaeed18/dotclaude · .claude-plugin/plugins/docs/skills/technical-writing/SKILL.md · Write and edit developer documentation, guides, design notes, and engineering blog posts with a working writer's…
khaledsaeed18/dotclaude · .claude-plugin/plugins/engineering/skills/adversarial-reviewer/SKILL.md · Review code through three hostile personas - the Saboteur, the New Hire, and the Security Auditor - each required to…
khaledsaeed18/dotclaude · .claude-plugin/plugins/engineering/skills/api-design-review/SKILL.md · Review an API contract (REST or GraphQL) before or while it is implemented, checking resource naming, HTTP semantics…
khaledsaeed18/dotclaude · .claude-plugin/plugins/engineering/skills/code-review-response/SKILL.md · Process code-review feedback with technical rigour. Understand each point, check it against the actual codebase, and…
khaledsaeed18/dotclaude · .claude-plugin/plugins/engineering/skills/db-migration-safety/SKILL.md · Review or write a database schema migration with production safety as the bar, checking locks, table rewrites…
khaledsaeed18/dotclaude · .claude-plugin/plugins/engineering/skills/dockerfile-best-practices/SKILL.md · Write or review a Dockerfile and compose setup for a production service: multi-stage builds that ship only the runtime…
khaledsaeed18/dotclaude · .claude-plugin/plugins/engineering/skills/error-handling-patterns/SKILL.md · Design and review error handling in a codebase: which errors are expected results versus bugs, typed error hierarchies…
khaledsaeed18/dotclaude · .claude-plugin/plugins/engineering/skills/executing-plans/SKILL.md · Execute a written implementation plan task by task, reviewing it critically first, following each step exactly, running…
wshobson/agents · plugins/framework-migration/skills/dependency-upgrade/SKILL.md · Manage major dependency version upgrades with compatibility analysis, staged rollout, and comprehensive testing. Use…
dicklesworthstone/pi_agent_rust · tests/ext_conformance/artifacts/agents-wshobson/framework-migration/skills/dependency-upgrade/SKILL.md · Manage major dependency version upgrades with compatibility analysis, staged rollout, and comprehensive testing. Use…
secondsky/claude-skills · plugins/dependency-upgrade/skills/dependency-upgrade/SKILL.md · Secure dependency upgrades with supply chain protection, cooldowns, and staged rollout. Use when upgrading deps…
byerlikaya/claude-starter-kit · claude-starter/skills/dependency-upgrade/SKILL.md · Bring dependencies current without breaking the build: find what is vulnerable, deprecated or behind,
classify each…
byerlikaya/claude-starter-kit · plugin/skills/dependency-upgrade/SKILL.md · Bring dependencies current without breaking the build: find what is vulnerable, deprecated or behind,
classify each…
rudycity/superagent · .agents/skills/dependency-upgrade/SKILL.md · Manage major dependency version upgrades with compatibility analysis, staged rollout, and comprehensive testing. Use…
scriptedalchemy/agent-bundle · examples/skills-starter/src/skills/dependency-upgrade/SKILL.md · Plan, implement, or review a dependency upgrade that may change APIs or runtime. Use when bumping or replacing a…
