dependency-upgrade
This skill automates the process of updating project dependencies while prioritizing security against supply chain threats. It integrates seamlessly with Claude Code CLI to manage package upgrades safely and efficiently.
dependency-upgrade automates the process of updating project dependencies while prioritizing security against supply chain threats. It integrates seamlessly with Claude Code CLI to manage package upgrades safely and efficiently, implementing staged rollout strategies, automated testing, and pre-installation auditing to prevent supply chain attacks during the upgrade process.
AI-generated summary based on this skill's SKILL.md
Install
secondsky/claude-skills/dependency-upgrade · repository language: TypeScript
git clone https://github.com/secondsky/claude-skills
cp -r claude-skills/plugins/dependency-upgrade/skills/dependency-upgrade ~/.claude/skills/dependency-upgradeFrequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
How does dependency-upgrade help to upgrade npm dependencies safely?
dependency-upgrade automates the process of updating project dependencies while prioritizing security against supply chain threats. It integrates seamlessly with Claude Code CLI to manage package upgrades safely and efficiently, implementing staged rollout strategies, automated testing, and pre-installation auditing to prevent supply chain attacks during the upgrade process.
What methods does dependency-upgrade use to prevent supply chain attacks in package managers?
dependency-upgrade employs multiple supply chain attack prevention techniques across all major package managers. It validates packages before installation through pre-install auditing tools, disables risky postinstall scripts by default, enforces lockfile validation in CI/CD pipelines, implements typosquatting protection, and integrates security scoring mechanisms to harden package manager security comprehensively.
Can dependency-upgrade configure a cooldown period for package updates?
Yes, dependency-upgrade supports configuring automated dependency updates with built-in testing and cooldown periods. This allows teams to stagger updates across environments, validate changes through automated testing before production deployment, and maintain stability while ensuring security patches are applied systematically without overwhelming the system.
How does dependency-upgrade handle major version upgrade path planning?
dependency-upgrade enables teams to plan and execute staged major version upgrades by analyzing dependency trees, identifying breaking changes, and orchestrating rollouts across development, staging, and production environments. This approach minimizes disruption while ensuring thorough testing at each stage before advancing to the next phase.
What security hardening features does dependency-upgrade provide across pnpm, bun, yarn, and npm?
dependency-upgrade hardens package manager security across all major tools by enforcing frozen lockfiles in CI/CD, validating npm provenance and 2FA publishing requirements, resolving peer dependency conflicts safely, and integrating with pre-install auditing solutions. It provides consistent security policies regardless of which package manager your project uses.
Does dependency-upgrade monitor bundle size impact after upgrades?
dependency-upgrade tracks bundle size impact after upgrades as part of its comprehensive validation process. By measuring size changes alongside automated testing and security auditing, it ensures that dependency updates don't introduce unexpected bloat while maintaining the security and stability improvements that upgrades provide.
SKILL.md
rendered from the published skill — quoted content, verbatim
Dependency Upgrade
Manage dependency upgrades with supply chain security, compatibility analysis, staged rollout, and comprehensive testing across all major package managers.
When to Use This Skill
- Upgrading major framework or library versions
- Configuring supply chain attack prevention (cooldown, script blocking, lockfile hardening)
- Setting up secure package manager configuration
- Resolving dependency conflicts or peer dependency issues
- Planning incremental upgrade paths with testing
- Automating dependency updates with Renovate, Dependabot, or Snyk
- Auditing dependencies for vulnerabilities
- Setting up CI/CD dependency security workflows
Two Modes of Operation
Interactive — Walk through setup questions to generate tailored config. Use for fresh setup.
Default — Apply recommended defaults immediately: 7-day cooldown, block all scripts, frozen-lockfile, lockfile-lint, Dependabot with cooldown. Customization
(truncated - see the full file via the links below)
Read as markdown · JSON record · Browse the source repository
File tree — 15 files
plugins/dependency-upgrade/skills/dependency-upgrade/SKILL.md
plugins/dependency-upgrade/skills/dependency-upgrade/references/compatibility-matrix.md
plugins/dependency-upgrade/skills/dependency-upgrade/references/cooldown-config-guide.md
plugins/dependency-upgrade/skills/dependency-upgrade/references/package-manager-security.md
plugins/dependency-upgrade/skills/dependency-upgrade/references/secrets-and-containers.md
plugins/dependency-upgrade/skills/dependency-upgrade/references/socket-cli-guide.md
plugins/dependency-upgrade/skills/dependency-upgrade/references/staged-upgrades.md
plugins/dependency-upgrade/skills/dependency-upgrade/references/supply-chain-security.md
plugins/dependency-upgrade/skills/dependency-upgrade/references/testing-strategy.md
plugins/dependency-upgrade/skills/dependency-upgrade/scripts/generate-dependency-upgrades.sh
plugins/dependency-upgrade/skills/dependency-upgrade/templates/bunfig-security.tmpl
plugins/dependency-upgrade/skills/dependency-upgrade/templates/dependabot-security.tmpl
plugins/dependency-upgrade/skills/dependency-upgrade/templates/devcontainer-security.tmpl
plugins/dependency-upgrade/skills/dependency-upgrade/templates/npmrc-security.tmpl
plugins/dependency-upgrade/skills/dependency-upgrade/templates/pnpm-workspace-security.tmpl