Plan, batch, and verify dependency upgrades safely. Triages outdated packages into risk tiers, upgrades in order (dev/minor/patch first, runtime majors last), verifies each batch, and produces an auditable commit sequence.
SkillScore87Maintained
Automatic
◆Coding pack
Last verified 10/10/2026
What it changes
Passed 20 of 23 test cases with the skill, and 13 of 23 without it.
Without skill57%
With skill87%
Checks it passed that the model alone missed
Prefixes the git commit summary line with deps: bump.
Upgrades vulnerable direct dependencies in a verified batch commit.
Structures immediate major migration work as a dedicated slice S##.
and 6 more in the full report
8 fixed12 passed either way2 still failing1 broke1 errored
Pass-rate lift
+30 pp
Tokens
+64%
Agent turns
0%
Response time
-12%
Model gemini-3.6-flashMeasured 10/10/2026v220 of 24 cases passed with skill · 23 comparable
Tokens, turns and time describe resource use, not a dollar price.
See it in action
One of 8 test cases the skill fixed. Same model, same prompt, with and without the skill.
1 of 8
Prompt
We finished batch 1 upgrading `@types/node` from 18.11.0 to 18.11.9 and `eslint-plugin-react` from 7.32.0 to 7.33.2. All tests, builds, and linters passed cleanly. Format the exact git commit message for this batch.
What was checked, without and with the skill
Checked
Without skill
With skill
Prefixes the git commit summary line with deps: bump.
Missed
Passed
Includes explicit test and build verification results in the commit body.
Passed
Passed
case-15 · gemini-3.6-flash · 10/10/2026 · answers are capped and redacted
What's inside
The instructions your model reads when the skill loads.
<core_principle>
BATCH BY RISK, NOT BY LAZINESS.npm update is a shortcut that blends safe and risky changes into one commit. When something breaks, you can't tell which dep caused it. Always separate: patches and dev-deps first, minors next, majors individually.
VERIFY BETWEEN BATCHES. Run the test suite after every batch. Don't stack five batches and hope. If a batch breaks something, you need to know which one.
ONE MAJOR PER COMMIT. Major version bumps are where real breakage lives. Keep them isolated so the commit history tells the truth.
</core_principle>
Step 1: Take inventory
Run the ecosystem's outdated check. Capture output, don't act on it yet:
Node: npm outdated or pnpm outdated or yarn outdated
Python: pip list --outdated or uv pip list --outdated
Rust: cargo outdated
Ruby: bundle outdated
Go: go list -m -u all
Also capture:
npm audit (or equivalent) — security advisories
Current versions of language runtime, build tool, test runner