Maintain Code Dependencies

Maintain Code Dependencies

Overview

Use this skill to run dependable dependency-maintenance work from discovery through verification and git handoff. Prefer small, reviewable changes; preserve user work; and keep security fixes moving even when optional upgrades need to wait.

Operating Loop

1. Establish repo state.

   • Run pwd, git status --short --branch, and inspect the project layout.
   • Identify package managers and lockfiles before running update commands.
   • Treat uncommitted changes as user work unless you created them. Do not revert unrelated changes.

2. Inventory dependencies and update signals.

   • Read manifest and lockfile pairs together.
   • Use ecosystem-native audit/outdated commands where available.
   • When the user asks for current releases, advisories, CVEs, or security postings, browse or use official advisory sources because this data changes frequently.
   • Separate security fixes, patch/minor upgrades, and major upgrades with breaking-change risk.

3. Choose an update strategy.

   • Prefer the narrowest change that fixes a known advisory.
   • For routine maintenance, batch compatible patch/minor updates by ecosystem.
   • Ask before broad major-version upgrades if they change frameworks, runtimes, APIs, database migrations, or deployment requirements.
   • Keep lockfiles in sync with manifests.

4. Apply updates.

   • Use the package manager already represented by the lockfile.
   • Avoid mixing package managers unless the repo already does.
   • Capture notable command output: updated packages, advisory IDs, failing tests, and remediation hints.
   • If a command fails because dependencies must be downloaded, request network escalation and retry the same package-manager command.

5. Verify and iterate.

   • Run the repo's relevant checks: tests, build, typecheck, lint, formatting, or targeted smoke tests.
   • Fix failures caused by the update, then rerun the smallest useful failing check before the broader suite.
   • Do not paper over failing tests by weakening assertions unless the behavior change is intentional and explained.
   • If unrelated failures pre-exist, document evidence and avoid claiming full verification.

6. Commit and push when requested.

   • Review git diff and git status --short before staging.
   • Stage only files related to the maintenance work.
   • Use a direct commit message such as chore: update npm dependencies or fix: address dependency advisories.
   • Push only when the user asked for it or the task clearly includes pushing.

Ecosystem Commands

Use references/ecosystems.md when you need package-manager-specific commands for JavaScript, Python, Ruby, Rust, Go, .NET, Java, or PHP projects.

Reporting

End with a concise maintenance report:

• What changed: package names and notable versions when practical.
• Why: routine update, security advisory, compatibility fix, or requested upgrade.
• Verification: exact checks run and their result.
• Git state: commit hash and push result when applicable, or remaining uncommitted files.
• Residual risk: skipped major upgrades, unresolved advisories, unavailable network/advisory checks, or pre-existing failures.