Library Updater

deps-update — Dependency Updater

Core: Update one dependency at a time. Research before updating. Test after each. Never batch untested changes.

THE EXACT PROMPT

Update all dependencies in this project to their latest stable versions.

For each dependency:
1. Use /research-software to find breaking changes between current and target version
2. Update the version
3. Run tests
4. Fix any issues (search web for recent solutions if needed)
5. If unfixable after 3 attempts, rollback and log why

Log everything to UPGRADE_LOG.md. Ask me before any refactoring that touches >10 files.

Supported Languages

Workflow

Phase 1: Discovery

• Detect manifest: Cargo.toml | pyproject.toml | package.json | go.mod | Gemfile
• List dependencies with current versions
• Create UPGRADE_LOG.md from template

Phase 2: Per-Dependency Loop

For each dependency where current != latest stable:
│
├─ 1. RESEARCH (invoke research-software skill)
│     /research-software [package] changelog [current] to [latest]
│     → Get: breaking changes, deprecations, migration notes
│
├─ 2. UPDATE
│     Edit manifest → run install command
│
├─ 3. TEST
│     Run test suite
│     │
│     ├─ PASS → Log success, next dependency
│     │
│     └─ FAIL → Research fix (web search 2025-2026)
│               → Apply fix → Retest
│               → 3 failures? Rollback, log reason, continue
│
└─ 4. LOG to UPGRADE_LOG.md

Phase 3: Finalize

• Run full test suite
• Run security audit
• Complete UPGRADE_LOG.md summary

Commands Quick Reference

Full commands & gotchas: LANGUAGES.md

Version Rules

UPGRADE:  1.2.3 → latest stable (e.g., 1.3.0)
PRESERVE: alpha/beta/rc, git refs, path deps, nightly → note in log
SKIP:     if only alpha/beta available → stay on current stable

Failure Handling

Circuit Breakers — Stop and Ask User

• 5+ dependencies fail consecutively
• Total test failures exceed 10
• Estimated refactoring exceeds 20 files
• Security vulnerability introduced (detected by audit tools)

Rollback Procedure

# Git-based (preferred)
git checkout -- Cargo.toml Cargo.lock

# Or restore from backup
cp .upgrade-backup/Cargo.toml .

Integrating research-software

For each dependency upgrade, invoke the research-software skill:

/research-software [package-name] breaking changes [old-version] to [new-version]

This returns:

• Breaking changes with code examples
• Deprecation notices
• Migration guides
• Recent issues/PRs about upgrade problems

Why: research-software searches GitHub releases, changelogs, and recent web content more effectively than manual lookup.

Progress Tracking

Create claude-upgrade-progress.json for crash recovery:

{
  "status": "in_progress",
  "current": "serde",
  "completed": ["tokio", "anyhow"],
  "failed": [],
  "pending": ["reqwest", "tracing"]
}

Update after each dependency. Resume from this state if interrupted.

Validation

After all updates:

# Verify everything works
./scripts/validate-upgrade.sh

# Or manually:
# 1. Clean build
# 2. Full test suite
# 3. Security audit
# 4. No new deprecation warnings (or documented)

UPGRADE_LOG.md Format

# Dependency Upgrade Log

**Date:** 2025-01-16  |  **Project:** my-project  |  **Language:** Rust

## Summary
- **Updated:** 12  |  **Skipped:** 3  |  **Failed:** 1  |  **Needs attention:** 2

## Updates

### serde: 1.0.190 → 1.0.215
- **Breaking:** None
- **Tests:** ✓ Passed

### tokio: 1.35.0 → 1.40.0
- **Breaking:** `runtime::Handle::block_on` removed
- **Migration:** Replaced with `Runtime::block_on`
- **Tests:** ✓ Passed after fix

## Failed

### problematic-crate: 0.5.0 → 0.6.0
- **Reason:** Requires Rust 1.75+, project uses 1.70
- **Action:** Rolled back

## Needs Attention

### legacy-lib: 2.0.0 → 3.0.0
- **Issue:** Major API redesign, ~50 call sites
- **Migration guide:** https://example.com/migration

Reference Index

Anti-Patterns

❌ Batch updates — Update 10 deps, then test. Which one broke it? ❌ Skip research — "It's just a patch version" → surprise breaking change ❌ Ignore deprecations — They become errors in the next major ❌ Force through failures — If it won't fix in 3 tries, it needs human judgment