# Update Minor Deps

> Run this repository's recurring minor and patch dependency maintenance. Use when asked to refresh non-breaking dependencies, reproduce a PR like runmedev/runme#1150, keep dependencies from falling behind, or prepare the associated branch, tests, commit, and pull request according to CONTRIBUTING.md.

- Skill: `runmedev/update-minor-deps` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add runmedev/update-minor-deps`
- Raw SKILL.md: https://api.skillmd.com/api/skills/runmedev/update-minor-deps/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: runmedev (https://skillmd.com/u/runmedev)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/runmedev/update-minor-deps

---


# Update Minor Deps

## Overview

Perform the maintenance task that updates minor and patch dependencies, then fix the small regressions or stale test assumptions exposed by the new dependency graph.

## Workflow

1. Start from the repository root and inspect the working tree with `git status --short`. Do not overwrite unrelated user changes.
2. Read `CONTRIBUTING.md` before running project commands. Prefer its named Runme commands over ad hoc equivalents.
3. Create or use a branch named like `chore/minor-patch-dependencies`; add a date suffix if the branch already exists.
4. Run the repository's documented dependency update command, then tidy the root module:

```sh
runme run update-go-deps
go mod tidy
```

5. Review `go.mod` and `go.sum`; `git diff --stat -- go.mod go.sum` and `git diff -- go.mod go.sum` are useful for this. The expected baseline is dependency and checksum churn in the root module. Do not intentionally upgrade major versions or edit module paths unless the user asks.
6. Run focused tests first for any touched or failing packages. Use failures to find real compatibility regressions, not to mask problems.
7. Make narrowly scoped code or test fixes when the updated dependencies changed behavior. PR 1150 is the model: module updates plus small fixes for go-git/go-billy path-walk behavior and a stale Ctrl-C test input assumption.
8. Run the required final validation after changes:

```sh
runme run lint test
```

Use this exact Runme command for final validation, even if `CONTRIBUTING.md`, `Makefile`, or other project docs mention equivalent `make` targets. Do not substitute `make lint`, `make test`, `make fmt`, or other Make targets for the final validation step.

If integration dependencies are unavailable locally, try `runme run test-docker` and report exactly what could not be validated.

## Investigation Rules

- Treat root `go.mod` and `go.sum` as the normal output. Treat `.dagger/go.mod` as out of scope unless the user explicitly asks to update Dagger dependencies too.
- Keep fixes tied to dependency-update fallout. Avoid opportunistic refactors, broad formatting churn, and unrelated cleanup.
- When tests fail, isolate with package-level or test-level commands before editing. Capture the focused commands in the final PR summary.
- If a failure appears flaky, repeat the narrow test with `-count=3` before changing code.
- Preserve generated files unless a project command updates them as part of the normal workflow.

## PR Shape

Use a concise commit title. Use the same base title for the PR, plus the current date in `YYYY-MM-DD` format so recurring dependency PRs are easy to identify in lists:

```text
chore: update minor and patch dependencies
chore: update minor and patch dependencies (YYYY-MM-DD)
```

Commit with DCO signoff as required by this repo:

```sh
git commit -s -m "chore: update minor and patch dependencies"
```

Draft the PR summary with:

- The documented update command that was run.
- The dependency files updated.
- Any compatibility or test fixes made.
- The focused tests and `runme run lint test` result.

Open as a draft PR first, following `CONTRIBUTING.md`, unless the user asks otherwise.