Bump outdated Hex deps — inventory, snapshot changelogs, update, fix breaks, split reviewable PRs (patches bundled, majors solo). Use to upgrade/bump Elixir dependencies or when versions fall behind. NOT for deps.get failures (phx-investigate).
SkillScore67Maintained
Automatic
◆Coding pack
Last verified 9/3/2026
What it changes
Passed 13 of 20 test cases with the skill, and 5 of 20 without it.
Without skill25%
With skill67%
Checks it passed that the model alone missed
Specifies the --dry-run command line flag
Fixes source code before running /phx-verify again
Uses mix hex.package diff to obtain the changelog delta
and 10 more in the full report
10 fixed6 passed either way8 still failing0 broke
Pass-rate lift
+42 pp
Tokens
+42%
Agent turns
0%
Response time
-17%
Model gemini-3.6-flashMeasured 9/3/2026v516 of 24 cases passed with skill · 20 comparable
Tokens, turns and time describe resource use, not a dollar price.
See it in action
One of 10 test cases the skill fixed. Same model, same prompt, with and without the skill.
1 of 10
Prompt
We want to update only the package `phoenix_live_view` without being prompted interactively for a scope choice. Which command flag provides this scope targeting?
What was checked, without and with the skill
Checked
Without skill
With skill
Passes --pkg phoenix_live_view to specify the target package
Missed
Passed
case-24 · gemini-3.6-flash · 9/3/2026 · answers are capped and redacted
What's inside
The instructions your model reads when the skill loads.
SKILL.md115 lines5 files
Dependency Update (Freshness)
Inventory → update → fix breaks → grouped PRs. This is the only MUTATING
deps skill: it edits mix.exs, mix.lock, and source. Security scanning
stays in /phx-deps-audit; the vet ledger stays in /phx-deps-vet.
Usage
/phx-deps-update # inventory + interactive scope pick
/phx-deps-update --scope patch # bundle all patch bumps, one PR
/phx-deps-update --pkg phoenix_live_view # one package (+ coupled group)
/phx-deps-update --dry-run # inventory only, no changes
Iron Laws
NEVER cross a major version without an explicit mix.exs edit —
mix deps.update stays within requirements. Edit the constraint first;
add override: true only when mix hex.outdated <pkg> shows a
transitive consumer blocking. One major per PR
ALWAYS snapshot the changelog delta BEFORE updating — capture
deps/<pkg>/CHANGELOG.md, then delta via mix hex.package diff. Never
update blind
NEVER claim an update is safe without verification — run
/phx-verify (compile --warnings-as-errors + test). "Compiles" ≠ "works"
ALWAYS move coupled packages together — Phoenix core, Ecto, Ash,
Oban, telemetry families update in the SAME step/commit (see
references/coupled-groups.md)
NEVER commit a partial bump — mix.lock + mix.exs edits + (for
Phoenix-family) assets/package-lock.json in ONE commit
HAND OFF security to /phx-deps-audit — run it on the lock diff
before any PR; don't reimplement audit rules
hex.outdated exit 1 is normal — it means "deps are outdated", not
failure. Capture with || true