Dependency management

Batch all open Dependabot dependency upgrade PRs into a single PR

XRPLF/xrpl4j

After a Dependabot bump of oss-crs-infra/dependabot-pins.Dockerfile, resolve the human-readable version tag for each updated digest, fix the inline comment, and sync the digest to…

ossf/oss-crs

Workflow for updating gem dependencies and fixing CVEs in the ruby-git project: assess with bundle outdated and audit, edit the gemspec, test, then commit with conventional messages.

ruby-git/ruby-git

Albucore image processing conventions - shapes (H,W,C), dtypes (uint8/float32), benchmark-driven backend routing (OpenCV, NumPy, Torch CPU, LUT, NumKong), tests, and lockfile discipline.

albumentations-team/albucore

Process the oldest open pull request end-to-end: analyze the diff, add missing tests on that PR branch, resolve review comments (including Copilot) in a loop, fix test regressions, update…

itgalaxy/webfont

Audit open dependabot PRs in this repo. An agent skill from garfiec/Librechat-Mobile.

garfiec/Librechat-Mobile

Review and merge open dependency pull requests from Dependabot, Renovate and similar bots across the goreleaser organization and the caarlos0 user.

caarlos0/dotfiles

Sets up and maintains AzureML-ready Python projects as uv workspaces with devcontainers, a Makefile and job YAML, so local runs match cloud jobs and experiments stay reproducible.

Kilo-Org/kilo-marketplace

A skill your agent uses when designing multi-app Frappe architectures, deciding whether to split functionality into separate apps, or implementing cross-app communication patterns.

Impertio-Studio/Frappe_Claude_Skill_Package

Triage a CVE / Dependabot alert in a JS/TS project and recommend the least-invasive fix.

getlago/lago-front

Route code and dependency changes to relevant review dimensions based on affected files and folders.

microsoft/vstest

Snapshot the computational environment for a replication package — detects the analysis stack (R / Stata / Python) and emits the right lockfiles (renv.lock + sessionInfo.txt, requirements.txt /…

pedrohcgs/claude-code-my-workflow

Fix a PR that is failing due to security or vulnerability issues — npm/pnpm/yarn/bun audit failures, CVE alerts, Dependabot merge conflicts, Snyk failures, or GitHub security advisory blocks.

unional/typescript-blackbook

Upgrades every package under ./examples to the repository's latest signals version, runs pub upgrade on third-party dependencies, and fixes the resulting analysis problems.

rodydavis/signals.dart

Bumps gh-aw's pinned gh-aw-firewall version, rebuilds generated artifacts, and flags upstream spec or schema changes that need follow-up work.

github/gh-aw

Recreates every Flowfile development and build environment from scratch, with exact version pins and an explanation of what each Makefile target really does.

Edwardvaneechoud/Flowfile

Quick reference for using Bun to run TypeScript and JavaScript, install packages, bundle code, run tests and serve HTTP, with the key files and commands.

mweinbach/agent-coworker

Add or manage third-party dependencies in a Polylith workspace.

DavidVujic/python-polylith

Aligns a Lens extension's package.json ranges with the dependency versions bundled in the running Lens build, then reinstalls and rebuilds.

nevalla/lens-resource-map-extension

Audit SkiaSharp's native dependencies for security vulnerabilities and CVEs, including Component Governance (CG) alerts from the combined skiasharp-package Azure DevOps pipeline.

mono/SkiaSharp

A skill your agent uses when updating dependencies managed by uv: bumping a package version, upgrading the uv tool itself, updating torch/CUDA stack, switching transformers version, or regenerating…

ByteDance-Seed/VeOmni

A checklist for upgrading the pinned ONNX version and opset in ONNX Runtime, covering the files to change, archive hashes, patch rebasing and release-candidate handling.

microsoft/onnxruntime

An extremely strict maintainability review for abstraction quality, giant files, and spaghetti-condition growth.

diyanbogdanov/emend

Hermetic Rust crate building, testing, and formatting via Bazel targets.

Moosync/Moosync

Explains how changes to the Flowfile monorepo are gated, versioned and released, including version sync, stub and docs drift checks, Alembic migrations and pinned dependencies.

Edwardvaneechoud/Flowfile

Conventions for adding packages and apps to a TypeScript monorepo: project references, moon tasks, workspace dependencies and published package exports.

pierrecomputer/pierre

Keep dependencies up-to-date. An agent skill from github/rust-gems.

github/rust-gems

Scans a repository, its lockfiles and node_modules for known malicious npm package versions and install-time indicators, using a read-only Python scanner.

majiayu000/spellbook

Check dependencies for known vulnerabilities using npm audit, pip-audit, etc.

alirezarezvani/claude-code-tresor

Automated triage and fixing of Dependabot security vulnerabilities (IN-1189).

linuxfoundation/insights

Guides Gradle 9 build changes in apache/grails-core on the 8.0.x line, favoring the repo's convention plugins, BOM platforms and patterns over generic Gradle advice.

apache/grails-core

Bumps an existing Python dependency in getsentry/sentry through the repository's self-serve GitHub Actions workflow.

getsentry/sentry

Handle open dependabot PRs automatically. An agent skill from EmertonData/glide.

EmertonData/glide

Current Bun workspace guidance for isolated and hoisted linkers, catalogs, filters, scripts, dependency classes, lockfiles, lifecycle trust, caches, publishing, TypeScript package exports, and…

shepherdjerred/monorepo

Sets ground rules for a coding agent that edits its own Rust source: read the code and journal first, write tests first, commit small changes and check compilation after each file.

yologdev/yoyo-evolve

Guide for safely updating project dependencies. An agent skill from microsoft/haste.

microsoft/haste

Audits a project's dependencies for supply-chain risk: version-matched advisories for direct dependencies and the full lockfile tree, abandoned or archived upstreams, npm publisher concentration…

trailofbits/skills

Read the vendor's breaking changes, deprecations, migration notes and CVEs for every version between the one pinned now and the one being moved to, through the whatsnew MCP server's upgradenotes tool.

getknit/knit

A skill your agent uses when publishing or preparing to publish an npm package from this repository, especially the Skill Zoo CLI package under packages/cli.

luochang212/skill-zoo

Checks that the tools and Python packages needed for a math modeling paper workflow are installed and offers platform-specific install commands for anything missing.

jihe520/MathModelAgent

A skill your agent uses when managing Maven dependencies, resolving dependency conflicts, configuring BOMs, or optimizing dependency trees in Java projects.

TheBushidoCollective/han

Guides moving a Grails application from 7.x to Grails 8 and turns the official upgrade guide into a checklist of breaking changes.

apache/grails-core

Create batched Dependabot-style pull requests for GitHub security findings in axelixlabs/axelix, grouped by dependency surface such as master/front-end, master/build.gradle.kts, or starter Gradle…

axelixlabs/axelix

A skill your agent uses when the user mentions a Dotty PR, dotty (package/dependency) updates, or asks to update the .NET agent compatibility docs / net-agent-compatibility-requirements after tested…

newrelic/newrelic-dotnet-agent

Use after Phase 1 dependency updates are merged, before any Phase 2 propagation to sibling forks - runs the end-to-end devnet gate (up brings devnet/deploy/dev-server up, verify drives Chrome over…

Scaffold-Stark/scaffold-stark-2

Finds two or three well-maintained npm packages for a Front-End Checklist rule, checks download and release thresholds, and adds them to the rule's frontmatter.

thedaviddias/Front-End-Checklist

Fix a Renovate dependency-update PR with the minimal compatible code adaptation, extracting a dependency bump from a grouped PR only when the fix requires the new version.

mui/mui-public

Conventions for .mjs files in the Handsontable monorepo: native node: imports, top-level await, the tasks.json dispatcher and native modules instead of extra dependencies.

handsontable/handsontable