dependency-upgrader

# Dependency Upgrader ## Overview This skill drives safe, auditable dependency upgrades across ecosystems (npm/yarn/pnpm, pip/poetry/uv, cargo, go modules, bundler, maven/gradle, composer). The core discipline: **one upgrade per commit, tests green between each, and a known-good rollback point at all times**. Never bulk-upgrade everything and hope. Keywords: dependency upgrade, bump packages, outdated, semver, breaking change, changelog, migration guide, lockfile, CVE, security advisory, Dependabot, Renovate, rollback, npm audit, pip-audit. Use this skill when the user wants to update libraries, patch a vulnerability, migrate a major version, or vet an automated bump PR. ## Core Principles 1. **Isolate.** One package (or one tightly-coupled group) per commit. A failed upgrade must be revertable without touching unrelated work. 2. **Read before you write.** Always inspect the changelog / release notes / migration guide before bumping across a major version. 3. **Tiered risk.** Patch < minor < major. Batch low-risk; isolate high-risk. 4. **Test gate.** The test suite (or a defined verification command) must pass before each commit. No green, no commit. 5. **Always have a rollback.** Know the exact git SHA and lockfile state to return to. See `references/rollback.md`. ## Workflow Follow these steps in order. Do not skip the inventory or the changelog read. ### 1. Establish a clean baseline - Confirm the working tree is clean (`git status`). If not, stop and ...