Bump Dependencies
Use Taze to build one structured update plan, apply compatible ranged updates, and make major-version decisions as a
batch.
Workflow
Resolve the skill directory and run the helper from the target repository:
bash <skill-dir>/scripts/run-taze.sh --plan [--include package-a,package-b]
The JSON plan classifies every discovered update as apply, review-major, review, or skip-fixed. The helper
detects monorepos, includes locked versions during scans, and mirrors Bun minimum-release-age settings. If the
repository uses package-manager age gates or Bun catalogs, read
references/conditional-workflows.md for that active branch only.
If --dry-run was requested, present the plan and counts, then stop without changing manifests or lockfiles.
Select every ranged minor/patch update marked apply. Never auto-approve a major package by name. Present all
review-major and unknown updates in one decision batch with current version, target version, package role when
discoverable, and relevant migration/release notes. Apply only the majors the user selects.
If nothing is selected, report the no-op and stop. Otherwise write all selected updates in one command:
bash <skill-dir>/scripts/run-taze.sh --write --include package-a,package-b
Update matching root Bun catalog entries when present, preserving their existing range prefixes. Then run ni so the
repository's package manager updates its lockfile.
Inspect the manifest and lockfile diff. Run the narrowest package-manager or repository checks that exercise updated
dependencies, with extra attention to approved major migrations.
Invariants
- Fixed versions and non-semver protocols remain unchanged unless the user explicitly asks otherwise.
- Package arguments constrain both scan and write phases.
- The same maturity-period policy applies to scan and write.
- Do not infer compatibility from SemVer alone when repository evidence, peer ranges, or release notes indicate
otherwise.
Completion requires a reviewed plan, one manifest write for the selected set, a regenerated lockfile, and validation
evidence; dry-run completion requires the structured plan and zero writes.
1---2name: bump-deps3description: Use for dependency updates: bump npm/pnpm/yarn/bun packages, check outdated, or run taze.4---5
6# Bump Dependencies
7
8Use Taze to build one structured update plan, apply compatible ranged updates, and make major-version decisions as a
9batch.
10
11## Workflow
12
131. Resolve the skill directory and run the helper from the target repository:
14
15 ```sh
16 bash <skill-dir>/scripts/run-taze.sh --plan [--include package-a,package-b]
17 ```
18
19 The JSON plan classifies every discovered update as `apply`, `review-major`, `review`, or `skip-fixed`. The helper
20 detects monorepos, includes locked versions during scans, and mirrors Bun minimum-release-age settings. If the
21 repository uses package-manager age gates or Bun catalogs, read
22 [references/conditional-workflows.md](references/conditional-workflows.md) for that active branch only.
23
242. If `--dry-run` was requested, present the plan and counts, then stop without changing manifests or lockfiles.
25
263. Select every ranged minor/patch update marked `apply`. Never auto-approve a major package by name. Present all
27 `review-major` and unknown updates in one decision batch with current version, target version, package role when
28 discoverable, and relevant migration/release notes. Apply only the majors the user selects.
29
304. If nothing is selected, report the no-op and stop. Otherwise write all selected updates in one command:
31
32 ```sh
33 bash <skill-dir>/scripts/run-taze.sh --write --include package-a,package-b
34 ```
35
365. Update matching root Bun catalog entries when present, preserving their existing range prefixes. Then run `ni` so the
37 repository's package manager updates its lockfile.
38
396. Inspect the manifest and lockfile diff. Run the narrowest package-manager or repository checks that exercise updated
40 dependencies, with extra attention to approved major migrations.
41
42## Invariants
43
44- Fixed versions and non-semver protocols remain unchanged unless the user explicitly asks otherwise.
45- Package arguments constrain both scan and write phases.
46- The same maturity-period policy applies to scan and write.
47- Do not infer compatibility from SemVer alone when repository evidence, peer ranges, or release notes indicate
48 otherwise.
49
50Completion requires a reviewed plan, one manifest write for the selected set, a regenerated lockfile, and validation
51evidence; dry-run completion requires the structured plan and zero writes.
om-scogo