update-deps

# Update Dependencies Audit outdated packages, verify supply chain integrity, bump what's safe, defer what needs review, and log everything. This process has three phases: discovery, integrity audit, and execution. The integrity audit is the most important — every package gets checked before it touches the lockfile. ## Phase 1: Discovery Run `bun outdated` to get the full list of packages with available updates. ```bash bun outdated ``` Parse the output into a structured list. For each package, note: - Package name - Current version - Available update version - Whether it's age-gated (indicated by `*` in the output — the footnote "The * indicates that version isn't true latest due to minimum release age" confirms this) - Whether it's a runtime dep, dev dep, or peer dep Also check whether any packages are blocked entirely by the age gate (like `@pierre/diffs` was when its minimum semver range couldn't resolve). Flag these separately — they may need `minimumReleaseAgeExcludes` in `bunfig.toml`. ## Phase 2: Integrity Audit This is the core of the process. Spawn one **Sonnet sub-agent per package** to run the integrity check in parallel. Sonnet is used here because these are independent, structured verification tasks that don't need heavier reasoning. Each sub-agent receives the package name, current version, and target version, and performs the following checks: ### Sub-agent prompt template For each outdated package, spawn a Sonnet agent with this task: ``` You are...