Plan a dependency upgrade with pinned compatibility evidence, controlled lockfile changes, staged validation, release gates, and honest recovery.
A package manager can resolve a graph that still fails at runtime. A green unit suite can miss a broken plugin, changed default, native binary, generated artifact, or rollback path. And a one-line version bump can quietly replace half a lockfile when the package-manager version changes.
This skill treats the upgrade as a release contract. It inventories the graph and current baseline, binds claims to exact registry and maintainer sources, builds a compatibility matrix, isolates the smallest coherent upgrade set, reviews supply-chain and lockfile changes, and maps validation to a staged rollout. The result includes a verdict, evidence register, eight-stage plan, measurable gates, and separate code, dependency, artifact, data, and forward-repair paths.
Use it for a major framework jump, a security-driven update, end-of-life migration, peer conflict, workspace-wide package change, or any lockfile diff that deserves more scrutiny than ‘the build passed.’ It starts read-only and never treats force flags, moving remote scripts, or invented test results as evidence.
Input
Review a React 18 to 19 upgrade in a pnpm monorepo. Next.js, the test renderer, two editor plugins, and an internal component package have different peer ranges. A developer used --force and a remote latest codemod to make CI compile.
Output
A do-not-proceed verdict on the forced graph and moving transform; a pinned evidence register and compatibility matrix; a split upgrade set; isolated codemod review; lockfile and supply-chain checks; changed-behavior tests; canary gates; and separate dependency, artifact, protocol, and forward-repair paths.
Input
A production advisory names a vulnerable transitive parser. The fixed version conflicts with a direct reporting library's declared range, the lockfile contains two parser majors, and the deadline is 48 hours. Decide whether an override, parent upgrade, or isolated mitigation is safe.
Provide the repository or artifact in scope, manifests and lockfiles, package-manager and runtime versions, current and requested dependency versions, workspaces and deployment targets, available release notes or advisories, baseline build and test results, release constraints, monitoring, and recovery context. The skill returns an evidence-bound verdict and staged plan without installing packages or changing the repository unless you explicitly approve exact commands and targets.
The current dependency resolution and requested target: manifests, lockfiles, package or framework names, current versions, target versions or constraints, and the reason for the upgrade.
Package-manager and runtime versions, workspaces, peers, plugins, direct and transitive constraints, build images, supported platforms, private registries, and downstream consumers when known.
Existing clean-install, build, type, lint, test, security, performance, canary, monitoring, and rollback paths plus owners, thresholds, deadlines, and known baseline failures.
Pinned registry metadata, release notes, migration guides, advisories, compatibility tables, artifact provenance, and exact source revisions. Missing evidence stays explicit and can block approval.
SKILL.md; dependency upgrade decision rubric; complete review report template; canonical machine-checkable record contract; read-only JSON validator; Agent Skills interface metadata
No reviews yet.
Output
A vulnerability-path inventory tied to the exact advisory and deployed graph; a comparison of parent upgrade, bounded override, and temporary mitigation; peer and behavior checks; an isolated lockfile diff; explicit residual exposure; release and observation gates; and a deadline-safe verdict that does not use urgency as compatibility proof.
Input
A pnpm lockfile changed by 9,000 lines while upgrading one SDK. CI uses pnpm 8, the developer used pnpm 10, five workspaces ship independently, a native image package changed its download host, and only Linux tests ran.
Output
A validate-first verdict; separation of package-manager and SDK changes; expected-versus-observed graph review; registry, integrity, lifecycle, native binary, workspace, and platform findings; reproducible regeneration steps; platform-specific validation; staged releases; and recovery that accounts for generated artifacts and independently deployed consumers.
Creator
Bbervio41
