From release
Smart dependency updates across ecosystems (npm/bun/pnpm, uv/poetry, cargo). Use when upgrading dependencies, fixing vulnerabilities, or performing proactive maintenance. Supports intelligent batching, risk assessment, and outcome tracking for continuous improvement.
npx claudepluginhub fairchild/dotclaude --plugin skill-creatorThis skill uses the workspace's default tool permissions.
Smart dependency management with security-first prioritization, intelligent batching, and learning from outcomes.
Generates design tokens/docs from CSS/Tailwind/styled-components codebases, audits visual consistency across 10 dimensions, detects AI slop in UI.
Records polished WebM UI demo videos of web apps using Playwright with cursor overlay, natural pacing, and three-phase scripting. Activates for demo, walkthrough, screen recording, or tutorial requests.
Delivers idiomatic Kotlin patterns for null safety, immutability, sealed classes, coroutines, Flows, extensions, DSL builders, and Gradle DSL. Use when writing, reviewing, refactoring, or designing Kotlin code.
Smart dependency management with security-first prioritization, intelligent batching, and learning from outcomes.
First, detect the project's ecosystem:
# Check for lockfiles (in priority order)
ls bun.lock bun.lockb pnpm-lock.yaml package-lock.json uv.lock poetry.lock Cargo.lock 2>/dev/null | head -1
| Lockfile | Ecosystem | Reference |
|---|---|---|
bun.lock / bun.lockb | npm (bun) | npm.md |
pnpm-lock.yaml | npm (pnpm) | npm.md |
package-lock.json | npm | npm.md |
uv.lock | Python (uv) | python.md |
poetry.lock | Python (poetry) | python.md |
Cargo.lock | Rust | cargo.md |
Load the appropriate ecosystem reference for detailed commands.
Run security check first. Security issues always take priority.
See ecosystem reference for specific audit command.
Categorize by severity:
Check for outdated dependencies.
Categorize by update type:
Before major updates, check if we've updated this package before:
grep "<package-name>" ~/.claude/skills/update-dependencies/data/outcomes.jsonl
Learn from past outcomes:
For packages with major bumps or unknown risk, fetch changelogs.
Score each update 1-5. See risk-assessment.md for guidelines.
Group related packages together. See grouping-strategies.md for patterns.
Priority order:
For each group:
deps/<group-name>-$(date +%Y%m%d)Use format from pr-format.md.
git add <lockfile> <manifest>
git commit -m "deps: <type> update <group-name>"
git push -u origin HEAD
gh pr create --title "deps: <type> update <group-name>" --body-file -
After PR is merged (or if update fails), log the outcome:
bun ~/.claude/skills/update-dependencies/scripts/log-outcome.ts
The script will:
~/.claude/skills/update-dependencies/data/outcomes.jsonlWhen invoked via /update-dependencies:
| Option | Effect |
|---|---|
security only | Only fix security vulnerabilities |
plan | Enter plan mode - analyze and design update strategy for approval |
major | Include major version updates |
group <name> | Update specific ecosystem group |
--check-history | Show past outcomes for packages being updated |
# Run the analyzer first
bun ~/.claude/skills/update-dependencies/scripts/analyze.ts
# Or invoke the skill
/update-dependencies plan # Analyze and plan
/update-dependencies # Full execution
If update fails partway:
git push -u origin HEADgh pr create ...