How do I install the Dependency Upgrade skill?

Run npx skillmds@latest add muhammedalkhudiry/dependency-upgrade in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

What does the Dependency Upgrade skill do?

Dependency upgrades, freshness audits, and unused-package cleanup. It is listed under Productivity on SkillMD.

Is Dependency Upgrade safe to use?

This skill has not completed SkillMD's automated safety review yet. Capability flags: docs only. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Dependency Upgrade?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Dependency Upgrade free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Dependency Upgrade?

MuhammedAlkhudiry (@muhammedalkhudiry) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Dependency Upgrade by muhammedalkhudiry

Name: Dependency Upgrade
Rating: 4.2 (5 reviews)
Author: MuhammedAlkhudiry

File contents

Workflow

Define the exact dependency scope and create the durable report before changing versions.
Establish the package manager, workspace and runtime boundaries, official project checks, and every in-scope dependency from manifests and lockfiles.
Use current package-manager help, manifests, lockfiles, runtime metadata, vendor release notes, upgrade guides, and advisories as sources of truth. Load $laravel or $react when applicable.
Upgrade with the project's package manager and apply straightforward compatibility fixes. Ask before broad migrations, architecture changes, many-file rewrites, unclear behavior changes, native rebuilds, or test-suite rewrites.
Verify risky batches and the final state. Finish only when every in-scope dependency is upgraded, removed, intentionally skipped, or blocked with a recorded reason.

Unused packages

Require evidence from manifests, imports, configuration, scripts, providers, tests, build tooling, and runtime integration before declaring a package unused.
Remove only clearly unused packages. Ask before removing anything with unclear dynamic, framework, plugin, or production-only usage.
Record removed, retained, and unclear candidates with evidence.

Patching

Do not permanently modify vendor files, installed dependencies, generated package output, or lockfile internals.
Remove diagnostic patches before finishing. If an upgrade requires a patch, fork, alias, Composer patch, patch-package, or monkey patch, skip it and request approval with cleaner alternatives.

Report

Create the report outside source control. Share its path early and update it after every dependency or batch.
On resume, read the report before continuing. Link it with the latest status in every final answer; a summary does not replace it.
Include every in-scope dependency, even when unchanged: package, ecosystem, old and new versions, reason, scan marker, dependency type, sources, notable changes, code/config/test changes, checks, patch status, and final status.

---name: dependency-upgradedescription: Dependency upgrades, freshness audits, and unused-package cleanup.---## Workflow1. Define the exact dependency scope and create the durable report before changing versions.2. Establish the package manager, workspace and runtime boundaries, official project checks, and every in-scope dependency from manifests and lockfiles.3. Use current package-manager help, manifests, lockfiles, runtime metadata, vendor release notes, upgrade guides, and advisories as sources of truth. Load $laravel or $react when applicable.4. Upgrade with the project's package manager and apply straightforward compatibility fixes. Ask before broad migrations, architecture changes, many-file rewrites, unclear behavior changes, native rebuilds, or test-suite rewrites.5. Verify risky batches and the final state. Finish only when every in-scope dependency is upgraded, removed, intentionally skipped, or blocked with a recorded reason.## Unused packages- Require evidence from manifests, imports, configuration, scripts, providers, tests, build tooling, and runtime integration before declaring a package unused.- Remove only clearly unused packages. Ask before removing anything with unclear dynamic, framework, plugin, or production-only usage.- Record removed, retained, and unclear candidates with evidence.## Patching- Do not permanently modify vendor files, installed dependencies, generated package output, or lockfile internals.- Remove diagnostic patches before finishing. If an upgrade requires a patch, fork, alias, Composer patch, `patch-package`, or monkey patch, skip it and request approval with cleaner alternatives.## Report- Create the report outside source control. Share its path early and update it after every dependency or batch.- On resume, read the report before continuing. Link it with the latest status in every final answer; a summary does not replace it.- Include every in-scope dependency, even when unchanged: package, ecosystem, old and new versions, reason, scan marker, dependency type, sources, notable changes, code/config/test changes, checks, patch status, and final status.

Frequently asked questions

Dependency Upgrade