# Dependency Upgrader

> Analyzes the impact of upgrading a package or framework version — identifies breaking changes, migration steps, deprecated APIs, and risk level. Works with npm, pip, cargo, go modules, gem, maven. Use this skill when the user asks to "upgrade X", "what breaks if I bump Y to Z", needs migration guidance for a major version, or wants to plan a dependency update.

- Skill: `kakarot-oncloud/dependency-upgrader` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add kakarot-oncloud/dependency-upgrader`
- Raw SKILL.md: https://api.skillmd.com/api/skills/kakarot-oncloud/dependency-upgrader/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: kakarot-oncloud (https://skillmd.com/u/kakarot-oncloud)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/kakarot-oncloud/dependency-upgrader

---


# Dependency Upgrader

You assess upgrade impact and produce a concrete migration plan.

## Process

1. **Identify** the package, current version, target version, and ecosystem.
2. **Determine the jump** — patch / minor / major / multi-major.
3. **Look up breaking changes** from the package's CHANGELOG, MIGRATION guide, or release notes.
4. **Scan the user's code** (if provided) for usages of removed, renamed, or behavior-changed APIs.
5. **Produce the plan** with concrete steps.
6. **Estimate effort** — trivial / small / medium / large.

## Output format

```markdown
## Upgrade summary
<package> <from> → <to>
Jump: <patch | minor | major | multi-major across N majors>
Estimated effort: <trivial | small (~1h) | medium (~half day) | large (1+ days)>
Risk: <low | medium | high>

## Breaking changes that affect this codebase
1. **<API name>** removed in vX.Y
   - Used in: `src/foo.ts:42`, `src/bar.ts:88`
   - Replacement: `<new API>`
   - Codemod available: <yes / no>

2. **<behavior change>**
   - Old: <behavior>
   - New: <behavior>
   - Affected: <where>

## Migration steps
1. <step>
2. <step>
3. Run: `<command>`
4. Test: `<what to verify>`

## Peer dep impact
- <package A> requires <X> ≥ <ver> — already satisfied / needs upgrade too
- <package B> may break — check separately

## Rollback plan
<how to revert if it goes wrong>
```

## Risk levels

- **Low** — patch or minor in a stable package, no usages of changed APIs.
- **Medium** — major bump but small surface area, codemods available.
- **High** — multi-major jump, framework-level (React, Django, Spring), heavy usage of changed APIs, no codemod.

## Rules

1. **Don't recommend "just upgrade".** Always identify the actual breaking changes that affect the code in front of you.
2. **Read the CHANGELOG**, not just the version diff. Many breaking changes are documented but not in code.
3. **Check peer deps and transitive deps.** A React upgrade may break MUI, react-router, testing libraries.
4. **Suggest one major at a time** for multi-major jumps (React 16 → 17 → 18, not 16 → 18 directly).
5. **Recommend lockfile commit** before upgrading so the diff is reviewable.
6. **Recommend running the test suite** at each step, not just at the end.
7. **Flag end-of-life versions** — if the user is on a version that no longer gets security patches, mention it.
8. **Don't blindly trust automated tools** like Dependabot for major bumps — the migration is rarely just a version bump.

## Common framework gotchas to flag

- **React 17→18**: automatic batching, Strict Mode double-effects, `ReactDOM.render` deprecated.
- **Node 16→18→20**: OpenSSL 3 changes, `fetch` builtin, deprecated APIs removed.
- **Python 3.x major bumps**: `distutils` removal, `asyncio` API changes, type hint syntax.
- **Django major**: middleware order, model field changes, deprecated settings.
- **Tailwind v3→v4**: config format, JIT defaults, plugin API.