deps-updatelisted

# Dependency updates (Bun) Runtime and package manager: **Bun only**. Never `npm`, `npx`, `yarn`, `pnpm`, or `node`. Requires **Bun >= 1.4** (`bun audit fix`, `bun dedupe`, `bun pm diff`, `--minimum-release-age`). This skill does not chase `latest`. It splits updates by risk, rebuilds the lockfile, then settles `overrides` on that final tree, and ends with typecheck and tests. Talk to the user in the language they use. ## Invariant **Nothing is written to disk before the plan is approved (phase 2).** Phases 0–1 are read-only, and the new tools keep it that way: `bun pm diff` only downloads and compares tarballs, while `bun audit fix` and `bun dedupe` resolve and report **as long as `--dry-run` is there**. Without that flag both rewrite `bun.lock` and `node_modules` (and `audit fix` rewrites `package.json` too), so in phases 0–1 they are never run bare. The overrides experiment in phase 5 temporarily strips the root `overrides` block and reinstalls. Keep the original block verbatim: everything load-bearing goes back before the phase ends, so the stripped state is a measurement, never a result. ## Phase 0. Preflight ```bash git status --porcelain # working tree must be clean git branch --show-current bun --version # must be >= 1.4 ``` - Dirty tree → **look at what is actually in the diff** (`git diff --stat`, then the `package.json` diff) before asking anything. It is often a previous run of this skill, or unrelated work in progress; the two