How do I install the 1k Pkg Upgrade Review skill?

Run npx skillmds add majiayu000/1k-pkg-upgrade-review in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is 1k Pkg Upgrade Review safe to use?

This skill has not completed SkillMD's automated safety review yet. Capability flags: makes network calls. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with 1k Pkg Upgrade Review?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is 1k Pkg Upgrade Review free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published 1k Pkg Upgrade Review?

majiayu000 (@majiayu000) published this skill. Their other Agent Skills are listed on their SkillMD profile.

1k Pkg Upgrade Review by majiayu000

Name: 1k Pkg Upgrade Review
Rating: 4.666666666666667 (3 reviews)
Author: majiayu000

File contents

Package Upgrade Review

Evaluates npm/yarn package version upgrades by performing source-level diff analysis, tracing all call sites, and producing a structured compatibility report.

Output language: Chinese (matching team conventions).

Quick Reference

Topic	Guide	Description
Review workflow	review-workflow.md	Step-by-step review process
Report template	report-template.md	Output format and risk guidelines
Example report	example-report.md	Real case: @isaacs/brace-expansion 5.0.0 -> 5.0.1

When to Use

Dependabot / Renovate PRs that bump dependency versions
Manual yarn upgrade or npm update changes
Any PR that modifies yarn.lock or package-lock.json
When team needs to understand what actually changed inside a package before merging

Workflow Overview

Identify the package name and version range (old -> new)
Download both versions from npm registry and extract
Diff source code between versions (focus on JS/TS, not metadata)
Classify changes: API signature, return value, new exports, removed exports, behavior changes
Search project source code for direct imports/usage
Search node_modules for indirect usage via intermediate packages
Trace each call site to verify argument usage and compatibility
Assess compatibility risks: signature, return type, return content, side effects
Generate structured report to node_modules/.cache/pkg-upgrade/
Post the full report as a PR comment via gh pr comment

Key Commands

# Download and extract both versions for diffing
mkdir -p /tmp/pkg-diff && cd /tmp/pkg-diff
curl -sL $(npm view PKG@OLD_VER dist.tarball) | tar xz -C old
curl -sL $(npm view PKG@NEW_VER dist.tarball) | tar xz -C new

# Compare file lists
diff -rq old/package new/package

# Diff main source
diff old/package/dist/commonjs/index.js new/package/dist/commonjs/index.js

# Search project code for direct usage
grep -r "PACKAGE_NAME" --include="*.ts" --include="*.tsx" --include="*.js" -l . \
  --exclude-dir=.git --exclude-dir=node_modules

# Search node_modules for indirect usage
grep -rn "from ['\"]PACKAGE_NAME['\"]" node_modules/ --include="*.js" --include="*.mjs" \
  | grep -v "node_modules/.cache"

# Check package metadata
npm view PKG@NEW_VER deprecated
npm view PKG@NEW_VER dist.integrity

Report Output

Local file: node_modules/.cache/pkg-upgrade/<package-name>-<old>-to-<new>.md
PR comment: The full report MUST also be posted as a comment on the PR via gh pr comment

Related Skills

/1k-code-review-pr - Comprehensive PR code review (security, code quality, platform patterns)

---name: 1k-pkg-upgrade-reviewdescription: Reviews package version upgrades — diffs source between versions, traces call sites, and generates compatibility reports.--- # Package Upgrade Review Evaluates npm/yarn package version upgrades by performing source-level diff analysis, tracing all call sites, and producing a structured compatibility report. **Output language**: Chinese (matching team conventions). ## Quick Reference | Topic | Guide | Description | |-------|-------|-------------| | Review workflow | [review-workflow.md](references/rules/review-workflow.md) | Step-by-step review process | | Report template | [report-template.md](references/rules/report-template.md) | Output format and risk guidelines | | Example report | [example-report.md](references/example-report.md) | Real case: @isaacs/brace-expansion 5.0.0 -> 5.0.1 | ## When to Use - Dependabot / Renovate PRs that bump dependency versions - Manual `yarn upgrade` or `npm update` changes - Any PR that modifies `yarn.lock` or `package-lock.json` - When team needs to understand what actually changed inside a package before merging ## Workflow Overview 1. **Identify** the package name and version range (old -> new) 2. **Download** both versions from npm registry and extract 3. **Diff** source code between versions (focus on JS/TS, not metadata) 4. **Classify** changes: API signature, return value, new exports, removed exports, behavior changes 5. **Search** project source code for direct imports/usage 6. **Search** `node_modules` for indirect usage via intermediate packages 7. **Trace** each call site to verify argument usage and compatibility 8. **Assess** compatibility risks: signature, return type, return content, side effects 9. **Generate** structured report to `node_modules/.cache/pkg-upgrade/` 10. **Post** the full report as a PR comment via `gh pr comment` ## Key Commands ```bash # Download and extract both versions for diffing mkdir -p /tmp/pkg-diff && cd /tmp/pkg-diff curl -sL $(npm view PKG@OLD_VER dist.tarball) | tar xz -C old curl -sL $(npm view PKG@NEW_VER dist.tarball) | tar xz -C new # Compare file lists diff -rq old/package new/package # Diff main source diff old/package/dist/commonjs/index.js new/package/dist/commonjs/index.js # Search project code for direct usage grep -r "PACKAGE_NAME" --include="*.ts" --include="*.tsx" --include="*.js" -l . \ --exclude-dir=.git --exclude-dir=node_modules # Search node_modules for indirect usage grep -rn "from ['\"]PACKAGE_NAME['\"]" node_modules/ --include="*.js" --include="*.mjs" \ | grep -v "node_modules/.cache" # Check package metadata npm view PKG@NEW_VER deprecated npm view PKG@NEW_VER dist.integrity ``` ## Report Output - **Local file**: `node_modules/.cache/pkg-upgrade/<package-name>-<old>-to-<new>.md` - **PR comment**: The full report MUST also be posted as a comment on the PR via `gh pr comment` ## Related Skills - `/1k-code-review-pr` - Comprehensive PR code review (security, code quality, platform patterns)

Frequently asked questions