From pixxle-skills
Safely bump repository dependencies — discover manifests via parallel sub-agents, baseline build/typecheck/tests, anchor latest versions to the internet (never guess, never downgrade), present a gated plan, apply one bump at a time on a fresh branch, validate after each, and auto-resolve source-only regressions (never modifying tests, hard stop on test-framework breakage). Use when user wants to upgrade packages, runtimes, or Docker base images safely. Triggers include "bump deps", "upgrade dependencies", "safely update packages", "/bump-deps".
How this skill is triggered — by the user, by Claude, or both
Slash command
/pixxle-skills:bump-depsThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
Safely upgrade a repository's dependencies — packages, language runtimes, and Docker base images — using a multi-agent flow with explicit user gates and a strict no-regress contract.
Safely upgrade a repository's dependencies — packages, language runtimes, and Docker base images — using a multi-agent flow with explicit user gates and a strict no-regress contract.
WebFetch of an official registry/release endpoint. Training-data knowledge is not a valid source.current > latest stable (e.g., a pinned pre-release that hasn't been promoted to stable), the dep is held until stable catches up. Applies to packages, runtimes, and Docker tags equally.latest-stable / LTS value in the plan carries the URL or CLI command it came from.Used to identify "this is a test-framework dep" for the hard-revert rule. Sub-agents may extend per ecosystem; extensions must be reported in their output for auditability.
xunit*, nunit*, MSTest*, Microsoft.NET.Test.Sdk, Moq, NSubstitute, FluentAssertions, Shouldly, coverlet*, AutoFixture*, Bogus.jest, vitest, @testing-library/*, mocha, chai, sinon, cypress, @playwright/*, playwright, @types/jest, @types/mocha, @vitest/*, ts-jest, jasmine, karma*.pytest*, unittest*, nose*, hypothesis, tox, coverage, mock.testify, ginkgo, gomega, gomock, mockery.rspec*, minitest.git status --porcelain → if non-empty, refuse with the list of changed files. Wait for explicit user override.<base-branch>.Walk the repo, skipping: node_modules, bin, obj, vendor, .git, dist, build, .next, target, .venv, __pycache__, coverage, .gradle.
Enumerate every file that looks like a dependency manifest, lockfile, runtime pin, or container spec — do not pre-filter by ecosystem; treat anything plausibly manifest-like as a candidate.
.sln (or directory containing one or more orphan .csproj) → one .NET project (include any Directory.Packages.props, Directory.Build.props, global.json, dotnet-tools.json).package.json + lockfile + its workspaces leaves) → one Node project. Standalone package.json (no workspace) → its own project.go.mod → one Go project.pyproject.toml / standalone requirements*.txt / Pipfile / Cargo.toml / Gemfile / pom.xml / build.gradle* → one project per group.Do not fragment too granularly: a sub-agent should reason holistically about shared package management within its unit.
runtimes-and-images sub-agent for: Dockerfiles, docker-compose*.yml, .nvmrc, .tool-versions (asdf/mise), global.json SDK pin, go.mod toolchain directive, .python-version, GitHub Actions runner/setup-action versions in .github/workflows/*.yml.Each sub-agent is given:
unknown).It must:
dotnet build, tsc --noEmit or framework build, go build ./..., cargo build).tsc --noEmit, mypy, golangci-lint, eslint, ruff, etc.).current, latest-stable, LTS-if-applicable via native CLI first, registry WebFetch as fallback:
dotnet list package --outdated --include-transitive and dotnet list package --vulnerable.npm outdated --json (or pnpm outdated --format=json, yarn outdated --json) and npm audit --json.go list -m -u all and govulncheck ./... (or osv-scanner).pip list --outdated --format=json (or poetry show --outdated) and pip-audit.https://hub.docker.com/v2/repositories/<image>/tags?page_size=100 (or registry API for non-DockerHub).low / medium / high. Default raise rules in §1.8.homepage / repository / project_urls)."<pkg> <new-version> breaking changes" — fallback only.If none yield content, mark breaking-changes: unknown — manual review recommended.
Prefer the registry's JSON API endpoint when available — faster and less noisy than HTML pages:
https://registry.npmjs.org/<pkg>https://api.nuget.org/v3-flatcontainer/<pkg>/index.jsonhttps://proxy.golang.org/<pkg>/@latesthttps://pypi.org/pypi/<pkg>/json## Project: <root path>
### Ecosystem: <node | dotnet | go | python | docker | runtimes-and-images | ...>
### Build: <command, cwd> → <ok | fail (≤30 line excerpt)>
### Typecheck/lint: <command | n/a> → <ok | fail (≤30 line excerpt)>
### Tests: <command, cwd> → pass=<N>/fail=<M>/skip=<K>
### Pre-existing failures (excluded from regression set)
- <test-id-1>
- ...
### Dependencies
| name | type | current | latest-stable | LTS | bump-size | risk | CVE | breaking-changes | usage-hotspots | anchored-source |
| ... | direct/dev/transitive | ... | ... | ... | patch/minor/major | low/med/high | CVE id or — | summary or "unknown" | file:line refs | URL or CLI |
### Runtime/image pins (if owned by this sub-agent)
| target | current | latest-stable | LTS | risk | anchored-source |
### Suggested order (lowest-risk first within this project)
1. ...
### Sub-agent notes / test-framework list extensions / fetch failures
- ...
low.low. Breaking-changes non-empty → medium.medium floor; high if breaking-changes mentions API removals or behavior changes touched by usage-hotspots.high floor.test-framework. Always offered to the user; never auto-resolved.Coordinator collects every sub-agent result before aggregating. If any sub-agent failed (crash, timeout, missing native tool, parse error):
Coordinator merges all sub-agent outputs into one master plan:
# | project | name | current → proposed | bump-size | risk | CVE | one-line summary@types/*, transitively coupled cluster, all patch-level, no CVE) may share a single ID.Print the master plan. Ask:
Which to apply? Reply in natural language or by IDs. Examples:
"all patches","all patch and minor, skip majors","only security fixes","do #3, #5, #9","all except #7 and #12","runtimes only","all","none".
For runtime rows that list both LTS and latest-stable, accept per-runtime preference here (e.g. "do #5 as latest stable, #6 as LTS"). Default is LTS when one exists; user may override.
Parse the answer, then echo back the resolved selection as two lists:
Will bump (in this order):
#3 <pkg> <old → new>
#5 <pkg> <old → new>
...
Will skip:
#7 <pkg> — major bump, user excluded
...
Ask for one final confirm token before any code change. Do not proceed without explicit confirmation.
git switch -c bump-deps/<base-branch>-<YYYYMMDD-HHMM>. Do not push.dotnet add <proj> package <pkg> --version <ver> (or edit Directory.Packages.props and run dotnet restore if central package management is in use).npm install <pkg>@<ver> / pnpm add <pkg>@<ver> / yarn add <pkg>@<ver> (preserve dev flag when applicable).go get <pkg>@<ver> && go mod tidy.poetry add <pkg>@<ver> or pin in requirements.txt then pip install -r requirements.txt.FROM lines in Dockerfile, image: in docker-compose; preserve digest pinning if originally pinned by digest.global.json / .nvmrc / go.mod toolchain / .python-version per the runtime's convention.
b. Verify the manifest + lockfile changed as expected (git diff --stat).
c. Commit: subject bump(<ecosystem>): <pkg> <old> → <new>; body lists CVE id (if any) and a 1–3 line breaking-changes summary. Lockfile changes are part of this same commit. Do not use --amend. Co-Authored-By per host conventions.
d. Run per-bump validation (Phase 5a) on the affected project only.
e. Pass → continue to next bump.
f. Fail → enter Phase 6.Rerun the project's build, typecheck/lint, and test command captured at baseline — same command, same cwd. Diff against baseline:
ok → fail.pass in baseline is now fail, or a new failure not present in baseline. Pre-existing baseline failures are ignored.After the batch:
When a per-bump validation fails:
Per failed signature (dedupe identical traces — e.g. 50 tests failing on one missing API → one entry with count):
❌ <Project> :: <TestName(s) — N occurrences>
Bump: <pkg> <old> → <new>
Mode: assertion-failure | exception | build-error | typecheck-error | timeout
Output: <≤30 lines, middle-truncated, with [...N lines elided] marker>
Suspicion: <high|medium|low> — <evidence-sentence with file:line>
Path: auto-resolvable | requires-test-edit | test-framework-breakage
Suspicion confidence:
Always cite evidence (file:line of the import or stack frame). Never invent a cause.
⚠️ Test-framework upgrade detected as likely cause.
Bump: <pkg> <old> → <new>
Reason: failing test imports symbols from <pkg> (recognized test framework).
Action: Reverting this bump. Test-framework upgrades are a separate trust
boundary and must be done as a dedicated, human-reviewed change.
Next: Added to "needs-manual-review" list; continuing with remaining bumps.
Revert with git revert <bump-sha> --no-edit. Add to the needs-manual-review list with full failure context. Continue with the next bump.
Only entered for build / typecheck / app-code test regressions.
yes (try to auto-resolve) / skip (revert this bump and continue) / abort (stop the whole run). Wait for explicit answer.yes: launch a focused resolution sub-agent with:
git show HEAD).*test* / *Test* / tests/ / __tests__/ path OR containing a recognized test-framework import. The test-file set is pinned at baseline time so the boundary is deterministic across iterations.fix: adapt to <pkg> <new> API change on top of the bump commit, continue with the next bump.git reset --hard <pre-bump-sha>), add to needs-manual-review with full failure context, continue with the next bump.After the §5b full-suite gate:
Print:
bump-deps run summary — branch bump-deps/<base>-<timestamp>
Applied (N):
• <pkg> <old → new> [risk] [CVE id if any]
• ...
Auto-resolved with source edits (M):
• <pkg> <old → new> — <one-line edit summary>
• ...
Reverted (P):
• <pkg> <old → new> — reason: <test-framework | auto-resolve cap | user-defer>
• ...
Needs manual review (Q):
• <pkg> — <one-line reason + pointer to failure context>
• ...
CVEs addressed: R
Holding (current ahead of stable): S
Ask:
Push branch and open a PR with this summary as the body?
yes:
git push -u origin <branch>.gh pr create --title "bump-deps: <YYYY-MM-DD>" --body <summary + test-plan>.## Test plan section listing the exact test commands rerun in §5b.no:
Never push without explicit confirmation.
npm / dotnet / go / pip / gh etc. is not installed, the sub-agent must report it explicitly. Do not WebFetch around a missing toolchain — the user needs to know coverage is degraded.@types/* patches and similar low-risk families may be applied as one commit bump(node): @types/* patches — only if all members are patch-level and none has a CVE."react": "19.0.0-rc" while stable is 18.x), the row reads current=19.0.0-rc, latest-stable=18.x.x, action: hold (pre-release ahead). Revisit once stable catches up.--amend, no --force. Every action is a new commit. Reverts are explicit git revert or git reset calls with their reasons printed.npx claudepluginhub pixxle/skillsCreates, edits, and optimizes skills for Claude Code, including drafting, evaluating with test prompts, iterating on performance, and improving skill descriptions for better triggering accuracy.