/update-dependencies

name: update-dependencies
description: "Upgrade project dependencies with breaking change research for major version updates. Use when the user asks to \"update dependencies\", \"upgrade packages\", \"upgrade dependencies\", \"update deps\", \"upgrade deps\", \"update npm deps\", \"update Swift packages\", \"cargo update\", \"go get updates\", \"bundle update\", or \"pip upgrade\"."

Update Dependencies

Upgrade project dependencies, researching breaking changes for major version updates.

Optional filter: `$ARGUMENTS` (e.g., `react`, `Alamofire`, `serde tokio`)

Task Tracking

At the start, use `TaskCreate` to create a task for each phase:

1. Run `/review-dependencies` skill 2. User strategy selection 3. Research breaking changes 4. User confirmation 5. Execute upgrades 6. Apply migrations 7. Run `/run-checks` skill 8. Exercise upgraded schema against the real store 9. Report results 10. Recommend next steps

Phase 1: Review Dependencies

Run the `/review-dependencies` skill to detect package managers and discover available updates. If no updates are available, stop.

Phase 2: User Strategy Selection

Before summarizing, set aside packages whose version tracks a pinned runtime or platform rather than the newest release, such as runtime type definitions and platform SDKs. Find the pin the project declares (version manager file, `engines` field, container base image, CI setup step) and hold any version beyond it until the pin moves.

Present a summary showing:

• Count and list of major updates (with current → target versions)
• Count of minor updates
• Count of patch updates
• Packages set aside, each with the pin that governs it

Use AskUserQuestion for upgrade strategy:

**Header**: "Strategy" **Options**:

• **Cautious** — Upgrade minor/patch first, then major one-by-one with research
• **All at once** — Research all major changes, then upgrade everything together
• **Skip major** — Only upgrade minor and patch versions
• **Interactive** — Ask for each major update individually

When a major upgrade would force a migration that is costly to reverse, present a **Get a second opinion** option in place of **Interactive**, keeping the question at four options. It runs the `/consult-codex` skill for which strategy the breaking changes warrant. Then resolve the strategy with that answer in hand, re-asking when the choice stays the user's. A freeform answer asking to decide each major update individually selects the Interactive strategy.

Phase 3: Research Breaking Changes

For **each package with a major version update**:

Step 1: Calculate Version Gap

Identify all major versions between current and target. For example:

• `react: 17.0.2 → 19.0.0` → research v18 AND v19 breaking changes
• `Alamofire: 4.9.1 → 6.0.0` → research v5 AND v6 breaking changes

Step 2: Research Each Major Version

Search for migration documentation:

WebSearch: "[package-name] v[X] migration guide"
WebSearch: "[package-name] v[X] breaking changes"

Common sources: GitHub releases page, official docs, changelog files.

Step 3: Extract Key Breaking Changes

Identify: API changes (renamed/removed functions), configuration changes, peer/transitive dependency requirements, behavioral changes, deprecated features now removed.

Step 4: Search Codebase for Affected Code

Use Grep to find usage of deprecated or changed APIs. Document which files are affected and what changes are needed.

Then check the package's installed consumers: read their declared peer or compatibility ranges and flag any range that excludes the target version. Toolchain consumers such as linters, type checkers, and build tooling can block a major even when the project's own code and configuration are clean. Carry each one into Phase 4 as a blocker.

Phase 4: User Confirmation

For each major update, present:

• Package name and version transition
• Breaking changes found (summarized)
• Files potentially affected (count and list)
• Consumers whose declared ranges block the upgrade, when Phase 3 found any

Use AskUserQuestion to confirm:

**Header**: "Confirm" **Options**:

• **Proceed** — Continue with upgrades and migrations
• **Show details** — Display detailed breaking changes for review
• **Skip package** — Exclude a specific package from upgrade
• **Abort** — Cancel the upgrade process

If "Show details" selected, display full migration research, then ask again.

Phase 5: Execute Upgrades

Report an outdated CI action pin for the user to act on and leave the workflow file unchanged; this skill upgrades packages a manifest declares.

After every install command in this phase, run both checks below before any tests and before Phase 6.

1. **Confirm the installed tree moved** — spot-check the resolved version of one or two upgraded packages in the installed dependency tree against the manifest. An install can record the new versions while leaving the installed packages on their old ones, which makes every later check report on the pre-upgrade tree. When the two disagree, force a clean resolve: use the package manager's lockfile-respecting install where it has one, otherwise clear the installed tree and install again. Re-check afterward. 2. **Diff the package-manager configuration** — inspect the package-manager config files for entries the tool wrote on its own. A tool enforcing a safety guard, such as a minimum age before a release is installable or a provenance requirement, may record a per-package exclusion rather than refusing. Treat such an entry as the guard being bypassed: revert it, then pin the manifest to the newest version the guard admits, which resolves without an exclusion.

Cautious Strategy

First upgrade minor and patch only using the package manager's semver-respecting update command, then run tests. If tests fail, stop before proceeding with major upgrades.

Major Version Upgrades

Update the manifest file (version constraint) and run the install/resolve command. For package