Dependency Upgrade Plan

Stale dependencies and "update everything" mandates create unmanageable risk and untraceable regressions. This skill transforms a wall of outdated packages into a structured, risk-batched execution plan that a release train can follow without guesswork.

What it does

• Inventory manifests by normalizing package.json, requirements.txt, go.mod, and Cargo.toml into a unified table of pinned vs. locked versions.
• Identify drift by flagging packages declared in manifests but missing from lockfiles or locked outside their declared ranges.
• Batch by risk to isolate patches, group minors by functional area, and separate every major version into its own individual PR/branch.
• Automate plan scaffolding by joining ecosystem-specific outdated captures (like npm outdated --json) with local inventory to quote exact version pairs.
• Validate handover readiness through a verification gate that ensures every batch includes specific commands for testing and rollback.

How it works

1. Run the inventory command to generate a normalized table of every direct and indirect dependency, identifying duplicates and deprecated packages.
2. Capture current ecosystem facts using your package manager's native outdated command to a JSON file.
3. Generate the plan skeleton which joins the inventory with the capture, sorting updates into the four mandatory risk tiers.
4. Fill in the verification and rollback fields for each batch based on the repository's specific test suite.
5. Execute the verify command to ensure no major bumps are hidden in patch batches and that no placeholders remain before committing the plan to the repo.

Frameworks & tools

The skill includes a Python helper script depplan.py and supports JavaScript (npm), Python (pip), Go (modules), and Rust (cargo). It integrates with native CLI tools like npm outdated, pip list, go list, and cargo-outdated.

Why this beats prompting it yourself

Generic prompts often "hallucinate" version numbers or suggest "update all" strategies that lead to dependency hell. This skill enforces a strict data-join between your lockfile and the ecosystem's actual registry data, ensuring every version quoted is real and every major bump is isolated.

Use cases

• Triage a massive backlog of outdated packages into a multi-day execution roadmap.
• Isolate a breaking major framework upgrade from routine security patches.
• Resolve lockfile churn where different developer machines are resolving different versions.
• Document the "why" behind specific version pins for future audits and team handovers.

Known limitations

Requires ecosystem-specific tools like cargo-outdated to be installed for JSON capture. It does not perform the actual npm install or pip install commands; it only generates the plan.