Upgrade Dependencies Without Breaking

The problem

Blindly running update commands often breaks builds, creates peer dependency conflicts, or introduces regressions through breaking changes. Developers lose hours manually untangling lockfiles or debugging removed APIs after a bulk upgrade.

What it does

• Detects package managers, lockfiles, and runtimes to ensure environment-appropriate commands.
• Performs staged upgrades, separating safe patches from minor and major version bumps.
• Executes baseline and post-upgrade validation including tests, type checks, and builds.
• Applies minimal compatibility fixes for changed imports or configuration formats.
• Generates a structured audit of changed versions, modified files, and deferred risks.

Frameworks & tools

Supports npm, pnpm, Yarn, pip, Poetry, uv, Composer, Cargo, and Go modules.

Why this beats prompting it yourself

General LLMs often suggest destructive "npm audit fix --force" style commands that corrupt environments. This skill follows a strict stability-first protocol, verifying the build at every step and refusing to delete lockfiles or hide vulnerabilities.

Use cases

• Modernizing legacy projects with deeply outdated dependency trees.
• Resolving complex peer dependency conflicts in existing lockfiles.
• Patching security vulnerabilities without triggering breaking changes.
• Automating routine monthly dependency maintenance safely.

Known limitations

Requires a local environment where tests and build commands can be executed for full validation. Major version migrations are deferred if the risk is unclear.