Bump outdated Hex deps — inventory, snapshot changelogs, update, fix breaks, split reviewable PRs (patches bundled, majors solo). Use to upgrade/bump Elixir dependencies or when versions fall behind. NOT for deps.get failures (/phx:investigate).
SkillScore80Maintained
Automatic
◆Coding pack
Last verified 8/19/2026
What it changes
Passed 18 of 23 test cases with the skill, and 12 of 23 without it.
Without skill52%
With skill80%
Checks it passed that the model alone missed
Uses the --pkg flag to restrict the update scope to broadway.
Queries GitHub release notes via the GitHub API as a fallback.
Creates a date-stamped scratch directory under .claude/deps-update/.
and 4 more in the full report
7 fixed13 passed either way5 still failing0 broke
Pass-rate lift
+28 pp
Tokens
+48%
Agent turns
0%
Response time
-40%
Model gemini-3.6-flashMeasured 8/19/2026v120 of 25 cases passed with skill · 23 comparable
Tokens, turns and time describe resource use, not a dollar price.
See it in action
One of 7 test cases the skill fixed. Same model, same prompt, with and without the skill.
1 of 7
Prompt
We only want to update the `broadway` package in our Elixir application without touching any other outdated packages. What command option specifies single package scope?
What was checked, without and with the skill
Checked
Without skill
With skill
Uses the --pkg flag to restrict the update scope to broadway.
Missed
Passed
case-20 · gemini-3.6-flash · 8/19/2026 · answers are capped and redacted
What's inside
The instructions your model reads when the skill loads.
SKILL.md115 lines5 files
Dependency Update (Freshness)
Inventory → update → fix breaks → grouped PRs. This is the only MUTATING
deps skill: it edits mix.exs, mix.lock, and source. Security scanning
stays in /phx:deps-audit; the vet ledger stays in /phx:deps-vet.
Usage
/phx:deps-update # inventory + interactive scope pick
/phx:deps-update --scope patch # bundle all patch bumps, one PR
/phx:deps-update --pkg phoenix_live_view # one package (+ coupled group)
/phx:deps-update --dry-run # inventory only, no changes
Iron Laws
NEVER cross a major version without an explicit mix.exs edit —
mix deps.update stays within requirements. Edit the constraint first;
add override: true only when mix hex.outdated <pkg> shows a
transitive consumer blocking. One major per PR
ALWAYS snapshot the changelog delta BEFORE updating — capture
deps/<pkg>/CHANGELOG.md, then delta via mix hex.package diff. Never
update blind
NEVER claim an update is safe without verification — run
/phx:verify (compile --warnings-as-errors + test). "Compiles" ≠ "works"
ALWAYS move coupled packages together — Phoenix core, Ecto, Ash,
Oban, telemetry families update in the SAME step/commit (see
${CLAUDE_SKILL_DIR}/references/coupled-groups.md)
NEVER commit a partial bump — mix.lock + mix.exs edits + (for
Phoenix-family) assets/package-lock.json in ONE commit
HAND OFF security to /phx:deps-audit — run it on the lock diff
before any PR; don't reimplement audit rules
hex.outdated exit 1 is normal — it means "deps are outdated", not
failure. Capture with || true