dependency-upgrade
This skill automates the process of updating project dependencies while prioritizing security against supply chain threats. It integrates seamlessly with Claude Code CLI to manage package upgrades safely and efficiently.
dependency-upgrade automates the process of updating project dependencies while prioritizing security against supply chain threats. It integrates seamlessly with Claude Code CLI to manage package upgrades safely and efficiently, implementing staged rollout strategies, automated testing, and pre-installation auditing to prevent supply chain attacks during the upgrade process.
AI-generated summary based on this skill's SKILL.md
Decision gist · record as of 2026-07-25
dependency-upgrade automates the process of updating project dependencies while prioritizing security against supply chain threats. It integrates seamlessly with Claude Code CLI to manage package upgrades safely and efficiently, implementing staged rollout strategies, automated testing, and pre-installation auditing to prevent supply chain attacks during the upgrade process.
Use it when
- dependency-upgrade employs multiple supply chain attack prevention techniques across all major package managers.
- Yes, dependency-upgrade supports configuring automated dependency updates with built-in testing and cooldown periods.
Verify before relying
Read SKILL.md below before installing (19 files). Open directory: indexed for reading, not audited.
Install
secondsky/claude-skills/dependency-upgrade · repository language: TypeScript
Open directory. Skills are indexed for reading, not audited. Review a skill's body before installing it.
Frequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
How does dependency-upgrade help to upgrade npm dependencies safely?
dependency-upgrade automates the process of updating project dependencies while prioritizing security against supply chain threats. It integrates seamlessly with Claude Code CLI to manage package upgrades safely and efficiently, implementing staged rollout strategies, automated testing, and pre-installation auditing to prevent supply chain attacks during the upgrade process.
What methods does dependency-upgrade use to prevent supply chain attacks in package managers?
dependency-upgrade employs multiple supply chain attack prevention techniques across all major package managers. It validates packages before installation through pre-install auditing tools, disables risky postinstall scripts by default, enforces lockfile validation in CI/CD pipelines, implements typosquatting protection, and integrates security scoring mechanisms to harden package manager security comprehensively.
Can dependency-upgrade configure a cooldown period for package updates?
Yes, dependency-upgrade supports configuring automated dependency updates with built-in testing and cooldown periods. This allows teams to stagger updates across environments, validate changes through automated testing before production deployment, and maintain stability while ensuring security patches are applied systematically without overwhelming the system.
How does dependency-upgrade handle major version upgrade path planning?
dependency-upgrade enables teams to plan and execute staged major version upgrades by analyzing dependency trees, identifying breaking changes, and orchestrating rollouts across development, staging, and production environments. This approach minimizes disruption while ensuring thorough testing at each stage before advancing to the next phase.
What security hardening features does dependency-upgrade provide across pnpm, bun, yarn, and npm?
dependency-upgrade hardens package manager security across all major tools by enforcing frozen lockfiles in CI/CD, validating npm provenance and 2FA publishing requirements, resolving peer dependency conflicts safely, and integrating with pre-install auditing solutions. It provides consistent security policies regardless of which package manager your project uses.
Does dependency-upgrade monitor bundle size impact after upgrades?
dependency-upgrade tracks bundle size impact after upgrades as part of its comprehensive validation process. By measuring size changes alongside automated testing and security auditing, it ensures that dependency updates don't introduce unexpected bloat while maintaining the security and stability improvements that upgrades provide.
SKILL.md
Rendered from the published skill. Quoted content, verbatim.
Dependency Upgrade
Manage dependency upgrades with supply chain security, compatibility analysis, staged rollout, and comprehensive testing across all major package managers.
When to Use This Skill
- Upgrading major framework or library versions
- Configuring supply chain attack prevention (cooldown, script blocking, lockfile hardening)
- Setting up secure package manager configuration
- Resolving dependency conflicts or peer dependency issues
- Planning incremental upgrade paths with testing
- Automating dependency updates with Renovate, Dependabot, or Snyk
- Auditing dependencies for vulnerabilities
- Setting up CI/CD dependency security workflows
Two Modes of Operation
Interactive — Walk through setup questions to generate tailored config. Use for fresh setup.
Default — Apply recommended defaults immediately: 7-day cooldown, block all scripts, frozen-lockfile, lockfile-lint, Dependabot with cooldown. Customization
(truncated - see the full file via the links below)
File tree — 15 files
plugins/dependency-upgrade/skills/dependency-upgrade/SKILL.md
plugins/dependency-upgrade/skills/dependency-upgrade/references/compatibility-matrix.md
plugins/dependency-upgrade/skills/dependency-upgrade/references/cooldown-config-guide.md
plugins/dependency-upgrade/skills/dependency-upgrade/references/package-manager-security.md
plugins/dependency-upgrade/skills/dependency-upgrade/references/secrets-and-containers.md
plugins/dependency-upgrade/skills/dependency-upgrade/references/socket-cli-guide.md
plugins/dependency-upgrade/skills/dependency-upgrade/references/staged-upgrades.md
plugins/dependency-upgrade/skills/dependency-upgrade/references/supply-chain-security.md
plugins/dependency-upgrade/skills/dependency-upgrade/references/testing-strategy.md
plugins/dependency-upgrade/skills/dependency-upgrade/scripts/generate-dependency-upgrades.sh
plugins/dependency-upgrade/skills/dependency-upgrade/templates/bunfig-security.tmpl
plugins/dependency-upgrade/skills/dependency-upgrade/templates/dependabot-security.tmpl
plugins/dependency-upgrade/skills/dependency-upgrade/templates/devcontainer-security.tmpl
plugins/dependency-upgrade/skills/dependency-upgrade/templates/npmrc-security.tmpl
plugins/dependency-upgrade/skills/dependency-upgrade/templates/pnpm-workspace-security.tmpl
Let your AI agent find skills like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 56,283 agent skills by what they can do, searchable in plain language.
wish › “Securely upgrade dependencies with supply chain attack prevention”
Give your agent the search over MCP, or paste the wish link into any chat. No install? Search from any chat →
Related skills
This skill equips developers with essential security practices for npm-based projects, covering dependency vetting, vulnerability detection, and safe package management workflows. Gain actionable guidance on hardening your supply chain and mitigating common risks in the Node.js ecosystem.
Streamline your project's dependency management with Bun through this Claude Code skill. Designed for seamless integration with Claude Code CLI, it provides a straightforward way to handle package installation and updates across your development workflow.
This skill automates the process of updating project dependencies, reducing the overhead of manual version management and compatibility checks. By integrating with your development workflow, it helps teams stay current with the latest package versions while maintaining stability and reducing technical debt.
Dependency Audit scans your project's installed packages for known vulnerabilities, detects secrets about to be committed, and verifies lockfile integrity. Run it once to report findings, or wire it into CI as a merge gate that blocks risky dependencies from reaching production.
This skill helps SAP developers detect and fix security weaknesses lurking in their project dependencies. By scanning your packages against known vulnerability databases, you can address supply chain risks before they reach production and keep your SAP applications hardened against emerging threats.
check-npm helps you systematically review package manager settings across npm, yarn, and pnpm to strengthen your project's supply-chain defenses. By analyzing configuration files and dependency practices, it surfaces misconfigurations that could expose your codebase to security risks. Use this skill to enforce hardening best practices and maintain a resilient software supply chain.
More skills npm-helper (MIT) · supply-chain-hardening (MIT) · dependency-management (MIT) · Devcontainer Setup (unlicensed) · audit-and-reduce-dependencies (Apache-2.0) · supply-chain-security (MIT) · Triage Dependabot Alerts (NOASSERTION) · absolute-upgrade (MIT)