/phx-deps-update

name: phx-deps-update
description: Bump outdated Hex deps — inventory, snapshot changelogs, update, fix
  breaks, split reviewable PRs (patches bundled, majors solo). Use to upgrade/bump
  Elixir dependencies or when versions fall behind. NOT for deps.get failures (phx-investigate).

Dependency Update (Freshness)

Inventory → update → fix breaks → grouped PRs. This is the only MUTATING deps skill: it edits `mix.exs`, `mix.lock`, and source. Security scanning stays in `phx-deps-audit`; the vet ledger stays in `phx-deps-vet`.

Usage

phx-deps-update                       # inventory + interactive scope pick
phx-deps-update --scope patch         # bundle all patch bumps, one PR
phx-deps-update --pkg phoenix_live_view   # one package (+ coupled group)
phx-deps-update --dry-run             # inventory only, no changes

Iron Laws

1. **NEVER cross a major version without an explicit `mix.exs` edit** — `mix deps.update` stays within requirements. Edit the constraint first; add `override: true` only when `mix hex.outdated <pkg>` shows a transitive consumer blocking. One major per PR 2. **ALWAYS snapshot the changelog delta BEFORE updating** — capture `deps/<pkg>/CHANGELOG.md`, then delta via `mix hex.package diff`. Never update blind 3. **NEVER claim an update is safe without verification** — run `phx-verify` (compile --warnings-as-errors + test). "Compiles" ≠ "works" 4. **ALWAYS move coupled packages together** — Phoenix core, Ecto, Ash, Oban, telemetry families update in the SAME step/commit (see `references/coupled-groups.md`) 5. **NEVER commit a partial bump** — `mix.lock` + `mix.exs` edits + (for Phoenix-family) `assets/package-lock.json` in ONE commit 6. **HAND OFF security to `phx-deps-audit`** — run it on the lock diff before any PR; don't reimplement audit rules 7. **`hex.outdated` exit 1 is normal** — it means "deps are outdated", not failure. Capture with `|| true`

Workflow

Phase 0: Discover

Read `mix.exs`: deps list, umbrella (`apps_path:`), git/path deps, private orgs (`organization:`/`repo:` in tuples), Phoenix/Ash presence. Create scratch dir `.claude/deps-update/{YYYY-MM-DD}/`.

Phase 1: Inventory

`mix hex.outdated --all || true` — parse the text table (no JSON exists; see `references/update-mechanics.md`). Classify each row patch/minor/major by semver delta; `Update not possible` = blocked major (mix.exs constraint). Write `inventory.md` to scratch. Render grouped table: Patch / Minor / Major / Blocked / Git-deps (manual). `--dry-run` stops here.

Phase 2: Scope (AskUserQuestion)

Present groups with counts and risk. Default recommendation: "Patches (N) — low risk, bundle into one PR". `--scope`/`--pkg` flags skip the prompt. When ≥2 members of a coupled group are outdated, force them into one step even under a narrower scope.

Phase 3: Per-Package Update Loop

For each selected package, in coupled-group order:

1. Snapshot `deps/<pkg>/CHANGELOG.md` → `scratch/before/` 2. Update — patch/minor: `mix deps.update <pkg> [coupled...]`; major: edit `mix.exs` constraint (+ `override: true` if needed), then `mix deps.update <pkg>` 3. `git diff mix.lock` → the REAL `{pkg, old, new}` set (hex.outdated says what could change; the lock diff says what did) 4. Changelog delta: `mix hex.package diff <pkg> <old>..<new>` — keep the CHANGELOG hunk. Empty → `gh api repos/{o}/{r}/releases` fallback → compare-URL note (see `references/changelog-sources.md`) 5. Write `scratch/{pkg}-{old}-{new}.md` 6. Phoenix-family in the diff + `assets/package.json` exists → `npm install --prefix assets`, stage `assets/package-lock.json` with the same commit

Phase 4: Verify

Run `phx-verify`. On failure → Phase 5; else Phase 6.

Phase 5: Breaking-Change Fixes

Read the changelog deltas for "breaking"/"removed"/"deprecated" + the compile/test errors. Fix source (apply the sibling-file check). Re-verify.

Phase 6: Security Handoff

Run `phx-deps-audit` on the working `mix.lock` diff (its Mode B default). BLOCK findings → surface and offer `phx-deps-vet <pkg> <ver>` for accepted risks. Never skip this before a PR.

Phase 7: Group, Commit, PR

Apply the splitting strategy (`references/pr-strategy.md`): patches bundled, minors by area, majors solo, coupled groups always together. PR bodies cite the changelog excerpt, the `https://diff.hex.pm/diff/<pkg>/<old>..<new>` link, verification result, and the deps-audit risk band. Stage lock + mix.exs + package-lock together.

Integration

phx-deps-update (mutating) → phx-deps-audit (security, Mode B)
        │                              │ BLOCK → phx-deps-vet (ledger)
        └→ phx-verify (gate) → grouped commits / PRs

References

• `references/update-mechanics.md` — hex.outdated parsing, update vs unlock+get, majors, lock-diff
• `references/changelog-sources.md` — hex.package diff, gh fallbacks, private orgs
• `references/coupled-groups.md` — must-move-together groups + edge cases
• `references/pr-strategy.md` — grouping rules, area buckets, PR template, scratch layout