Dependency Update Planner

Outdated dependencies introduce technical debt and subtle bugs. Blindly running update commands often breaks builds due to unexpected breaking changes. This skill analyzes your project to build a risk-aware upgrade roadmap.

What it does

• Version Analysis identifies patch, minor, and major updates for npm and Python ecosystems.
• Risk Assessment flags abandoned packages (2+ years stagnant) and bleeding-edge releases (under 7 days old).
• Update Classification treats 0.x minor bumps as breaking changes to prevent semver accidents.
• Drift Measurement calculates exactly how many days and versions each package trails the latest release.
• Batched Execution generates ordered install commands to manage complex dependency chains.

How it works

1. Source Scan reads package.json, package-lock.json, requirements.txt, or pyproject.toml (Poetry/PEP 621).
2. Registry Lookup queries npm and PyPI APIs for current version metadata and deprecation notices.
3. Logic Application filters updates based on age, stability, and version delta.
4. Plan Generation outputs a Markdown report with links to changelogs and exact shell commands.

Frameworks & tools

Supports Node.js (npm, yarn, pnpm) and Python (pip, Poetry). Uses public JSON APIs for registry.npmjs.org and pypi.org.

Why this beats prompting it yourself

Generic LLMs lack real-time registry data and often ignore the nuances of 0.x versioning. This skill integrates live API lookups to distinguish between a safe patch and a risky, unproven release.

Use cases

• Quarterly Maintenance to systematically reduce version drift across a monorepo.
• Pre-release Hardening by identifying and replacing abandoned or deprecated libraries.
• Incident Response to check if a local bug exists in a more recent, stable version.

Known limitations

Requires outbound network access to npm and PyPI registries. Does not perform local build testing or automated regression checks.