Node Dependency Bumper
Use Taze to build one structured update plan, apply compatible ranged updates, and make major-version decisions as a
batch.
Adding Dependencies
For a new package or CLI, use the repository's package manager and existing range convention instead of Taze. Installing
package@latest and retaining the package manager's resulting ^x.y.z range is allowed. Do not replace a caret range
with an exact version merely because it can admit future releases.
When an effective package-manager minimum-release-age policy exists, it provides the freshness boundary for candidate
versions; read references/conditional-workflows.md. The committed lockfile and
frozen deployment install provide reproducibility. Exact-pin only when the user or repository requires it, a known
compatibility constraint justifies it, or the package will run without a committed lockfile and frozen install.
Workflow
Resolve the skill directory and save the helper plan from the target repository:
bash <skill-dir>/scripts/run-taze.sh --plan [--include package-a,package-b] > <taze-plan.json>
The JSON plan classifies every discovered update as apply, review-major, review, or skip-fixed. The helper
detects monorepos, includes locked versions during scans, and mirrors Bun minimum-release-age settings. If the
repository uses package-manager age gates or Bun catalogs, read
references/conditional-workflows.md for that active branch only.
If --dry-run was requested, present the plan and counts, then stop without changing manifests or lockfiles.
Select every ranged minor/patch update marked apply. Never auto-approve a major package by name. Present all
review-major and unknown updates in one decision batch with current version, target version, package role when
discoverable, and relevant migration/release notes. Apply only the majors the user selects.
If nothing is selected, report the no-op and stop. If the root manifest uses Bun catalogs, preview the exact selected
catalog transitions from the accepted plan:
uv run <skill-dir>/scripts/update-bun-catalogs.py \
--root <repo> --plan <taze-plan.json> --include package-a,package-b
The preview is read-only. Missing catalog entries, conflicting plan rows, unsupported versions, or a catalog value
that no longer matches the plan fail before writes. The helper does not select upgrades.
Before the first manifest or lockfile write, discover and run the repository's standard validation suite against the
existing dependency state. Prefer its advertised aggregate check; otherwise run every exposed dependency-resolution,
build, test, typecheck, lint, formatting-check, codegen-check, and repository-invariant command. Use frozen or
non-writing modes where available, and record the exact commands for the post-bump rerun. Attribute every failure
before deciding whether it blocks. Proceed when an unrelated pre-existing failure is reproducible, can be compared
after the bump, and does not prevent dependency resolution or the checks needed to detect regressions; do not fix it
as part of the bump. Dependency or peer-resolution conflicts, actionable unsafe behavior, or a baseline that cannot
provide trustworthy before/after signal block the bump. In that case, stop with
### ⛔ Dependency bump blocked — baseline unusable and report the exact prerequisite and diagnostics without asking
for redundant authorization. Informational notices such as unavoidable deprecations do not block.
Write all selected Taze updates in one command:
bash <skill-dir>/scripts/run-taze.sh --write --include package-a,package-b
For Bun catalogs, rerun update-bun-catalogs.py with the same plan and include set plus --write. It atomically
updates every matching default/named catalog occurrence and preserves each existing ^, ~, or empty prefix. Then
run ni so the repository's package manager updates its lockfile.
Inspect the manifest and lockfile diff. Rerun the exact baseline commands, plus the narrowest checks that exercise
the updated dependencies and any required migrations. Treat every newly introduced error, type issue, check failure
(including tests, builds, lint, formatting, codegen, and repository invariants), dependency or peer-resolution
conflict, and actionable compatibility or safety warning as caused by the bump unless evidence shows otherwise.
Fix every issue caused by the bump, including required source or configuration migrations, while preserving intended
behavior. Do not suppress diagnostics, weaken validation, or change expected behavior merely to make checks pass.
After each fix, rerun the affected check, then rerun the complete recorded suite and require no new failures against
the accepted baseline. Only unrelated pre-existing failures meeting step 5's comparison requirements may remain. If
no clear safe fix exists within the task's authority, stop with ### ⚠️ Dependency regression decision required.
Present all such issues in one table with the evidence, affected locations, fix and revert options, and likely
effects. Do not report completion until the user chooses, the fix is applied or the offending update is reverted, the
lockfile is regenerated, and the complete suite meets that same baseline-comparison requirement.
User-Facing Output
Present plans as ### 📦 Dependency plan with counts and a compact table:
| ID |
Plan value |
Decision |
Package |
Current → target |
Type |
Notes |
Use the plan's exact apply, review-major, review, and skip-fixed values alongside plain-language decisions.
Assign stable IDs to rows needing a choice so the user can answer once. Use ### 🔎 Dry run — no files written for a
preview and ### ✅ No selected updates for a no-op.
Finish applied work with ### 🏁 Dependencies updated, a tree of changed manifests/lockfiles, and
### 🧪 Verification. Use ### ⚠️ Remaining review only for non-blocking informational matters, never for an
unresolved issue caused by the bump. Keep helper JSON, package/version strings, commands, and diagnostics exact and
undecorated.
Invariants
- Fixed versions and non-semver protocols remain unchanged unless the user explicitly asks otherwise.
- Caret ranges are valid for new dependencies and CLIs; do not describe them as unreproducible when a committed lockfile
and frozen install control resolution.
- Package arguments constrain both scan and write phases.
- The same maturity-period policy applies to scan and write.
- Bun catalog preview and write use the same accepted Taze plan and selected package set; stale plans never write.
- Do not infer compatibility from SemVer alone when repository evidence, peer ranges, or release notes indicate
otherwise.
Completion requires an attributed, comparison-safe pre-write baseline, a reviewed plan, the retained selected updates, a
regenerated lockfile, no new failure in the recorded suite or dependency-specific checks, and no unresolved issue caused
by the bump. Dry-run completion requires the structured plan and zero writes.
1---2name: node-deps-bumper3description: Use for dependency updates: bump npm/pnpm/yarn/bun packages, check outdated, or run taze.4---5
6# Node Dependency Bumper
7
8Use Taze to build one structured update plan, apply compatible ranged updates, and make major-version decisions as a
9batch.
10
11## Adding Dependencies
12
13For a new package or CLI, use the repository's package manager and existing range convention instead of Taze. Installing
14`package@latest` and retaining the package manager's resulting `^x.y.z` range is allowed. Do not replace a caret range
15with an exact version merely because it can admit future releases.
16
17When an effective package-manager minimum-release-age policy exists, it provides the freshness boundary for candidate
18versions; read [references/conditional-workflows.md](references/conditional-workflows.md). The committed lockfile and
19frozen deployment install provide reproducibility. Exact-pin only when the user or repository requires it, a known
20compatibility constraint justifies it, or the package will run without a committed lockfile and frozen install.
21
22## Workflow
23
241. Resolve the skill directory and save the helper plan from the target repository:
25
26 ```sh
27 bash <skill-dir>/scripts/run-taze.sh --plan [--include package-a,package-b] > <taze-plan.json>
28 ```
29
30 The JSON plan classifies every discovered update as `apply`, `review-major`, `review`, or `skip-fixed`. The helper
31 detects monorepos, includes locked versions during scans, and mirrors Bun minimum-release-age settings. If the
32 repository uses package-manager age gates or Bun catalogs, read
33 [references/conditional-workflows.md](references/conditional-workflows.md) for that active branch only.
34
352. If `--dry-run` was requested, present the plan and counts, then stop without changing manifests or lockfiles.
36
373. Select every ranged minor/patch update marked `apply`. Never auto-approve a major package by name. Present all
38 `review-major` and unknown updates in one decision batch with current version, target version, package role when
39 discoverable, and relevant migration/release notes. Apply only the majors the user selects.
40
414. If nothing is selected, report the no-op and stop. If the root manifest uses Bun catalogs, preview the exact selected
42 catalog transitions from the accepted plan:
43
44 ```sh
45 uv run <skill-dir>/scripts/update-bun-catalogs.py \
46 --root <repo> --plan <taze-plan.json> --include package-a,package-b
47 ```
48
49 The preview is read-only. Missing catalog entries, conflicting plan rows, unsupported versions, or a catalog value
50 that no longer matches the plan fail before writes. The helper does not select upgrades.
51
525. Before the first manifest or lockfile write, discover and run the repository's standard validation suite against the
53 existing dependency state. Prefer its advertised aggregate check; otherwise run every exposed dependency-resolution,
54 build, test, typecheck, lint, formatting-check, codegen-check, and repository-invariant command. Use frozen or
55 non-writing modes where available, and record the exact commands for the post-bump rerun. Attribute every failure
56 before deciding whether it blocks. Proceed when an unrelated pre-existing failure is reproducible, can be compared
57 after the bump, and does not prevent dependency resolution or the checks needed to detect regressions; do not fix it
58 as part of the bump. Dependency or peer-resolution conflicts, actionable unsafe behavior, or a baseline that cannot
59 provide trustworthy before/after signal block the bump. In that case, stop with
60 `### ⛔ Dependency bump blocked — baseline unusable` and report the exact prerequisite and diagnostics without asking
61 for redundant authorization. Informational notices such as unavoidable deprecations do not block.
62
636. Write all selected Taze updates in one command:
64
65 ```sh
66 bash <skill-dir>/scripts/run-taze.sh --write --include package-a,package-b
67 ```
68
697. For Bun catalogs, rerun `update-bun-catalogs.py` with the same plan and include set plus `--write`. It atomically
70 updates every matching default/named catalog occurrence and preserves each existing `^`, `~`, or empty prefix. Then
71 run `ni` so the repository's package manager updates its lockfile.
72
738. Inspect the manifest and lockfile diff. Rerun the exact baseline commands, plus the narrowest checks that exercise
74 the updated dependencies and any required migrations. Treat every newly introduced error, type issue, check failure
75 (including tests, builds, lint, formatting, codegen, and repository invariants), dependency or peer-resolution
76 conflict, and actionable compatibility or safety warning as caused by the bump unless evidence shows otherwise.
77
789. Fix every issue caused by the bump, including required source or configuration migrations, while preserving intended
79 behavior. Do not suppress diagnostics, weaken validation, or change expected behavior merely to make checks pass.
80 After each fix, rerun the affected check, then rerun the complete recorded suite and require no new failures against
81 the accepted baseline. Only unrelated pre-existing failures meeting step 5's comparison requirements may remain. If
82 no clear safe fix exists within the task's authority, stop with `### ⚠️ Dependency regression decision required`.
83 Present all such issues in one table with the evidence, affected locations, fix and revert options, and likely
84 effects. Do not report completion until the user chooses, the fix is applied or the offending update is reverted, the
85 lockfile is regenerated, and the complete suite meets that same baseline-comparison requirement.
86
87## User-Facing Output
88
89Present plans as `### 📦 Dependency plan` with counts and a compact table:
90
91| ID | Plan value | Decision | Package | Current → target | Type | Notes |
92| --- | ---------- | -------- | ------- | ---------------- | ---- | ----- |
93
94Use the plan's exact `apply`, `review-major`, `review`, and `skip-fixed` values alongside plain-language decisions.
95Assign stable IDs to rows needing a choice so the user can answer once. Use `### 🔎 Dry run — no files written` for a
96preview and `### ✅ No selected updates` for a no-op.
97
98Finish applied work with `### 🏁 Dependencies updated`, a tree of changed manifests/lockfiles, and
99`### 🧪 Verification`. Use `### ⚠️ Remaining review` only for non-blocking informational matters, never for an
100unresolved issue caused by the bump. Keep helper JSON, package/version strings, commands, and diagnostics exact and
101undecorated.
102
103## Invariants
104
105- Fixed versions and non-semver protocols remain unchanged unless the user explicitly asks otherwise.
106- Caret ranges are valid for new dependencies and CLIs; do not describe them as unreproducible when a committed lockfile
107 and frozen install control resolution.
108- Package arguments constrain both scan and write phases.
109- The same maturity-period policy applies to scan and write.
110- Bun catalog preview and write use the same accepted Taze plan and selected package set; stale plans never write.
111- Do not infer compatibility from SemVer alone when repository evidence, peer ranges, or release notes indicate
112 otherwise.
113
114Completion requires an attributed, comparison-safe pre-write baseline, a reviewed plan, the retained selected updates, a
115regenerated lockfile, no new failure in the recorded suite or dependency-specific checks, and no unresolved issue caused
116by the bump. Dry-run completion requires the structured plan and zero writes.
paulrberg