dependency-upgrade-auditorlisted

# Dependency upgrade auditor A major version's release notes describe everything that changed for everybody. Almost none of it applies to you. The work is intersecting their breaking-change list with the handful of APIs you actually call, and that intersection is usually small enough to check line by line. Reading a changelog top to bottom produces a summary of someone else's release. Reading it against your own import list produces a decision. ## Procedure ### 1. Extract what you actually use `<skill-dir>` is the directory this SKILL.md was loaded from — the skill installs outside your project, so its script is named by full path, never relatively. ``` python3 <skill-dir>/scripts/dep_usage.py react-router # one package python3 <skill-dir>/scripts/dep_usage.py --all # every direct dependency, summarised ``` The script reports the declared version range, every file importing the package, and the **specific named imports, called members and subpath imports** in use. That last list is the one that matters — it is what you check the changelog against. ### 2. Get the real changelog, not a summary of it Prefer, in order: the package's `CHANGELOG.md` in its published tarball or repository, the GitHub release notes for each intervening version, then a migration guide. Read every version between the installed one and the target, not just the target — breaking changes land in the majors you are skipping over. If you cannot reach the notes, **say so and stop**.