New: 97,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Dependency Upgrade Protocol

by dralgorhythm in dralgorhythm/claude-agentic-framework

Sequences safe dependency upgrades: read the changelog, verify the version exists upstream, pin it, and keep major bumps in separate commits behind a full gate run.

No licenceAuto-check passedDevelopment

Install Dependency Upgrade Protocol

skills CLI
$ npx skills add dralgorhythm/claude-agentic-framework --skill dependency-upgrade -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install dralgorhythm/claude-agentic-framework dependency-upgrade --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/dralgorhythm/claude-agentic-framework.git skills-src && mkdir -p .claude/skills && cp -r skills-src/.claude/skills/core-engineering/dependency-upgrade .claude/skills/dependency-upgrade && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
dependency-upgrade
GitHub stars
124
Token cost
~1.5k tokens
SKILL.md length
852 words
Files
3
Skills in repo
20
Repo updated
First seen
Licence
None found

At a glance

Sequences safe dependency upgrades: read the changelog, verify the version exists upstream, pin it, and keep major bumps in separate commits behind a full gate run.

  • Works in 4 steps: Security advisories first. A CVE fix… → Dev-dependencies before runtime… → Minors: batch per ecosystem. One commit… → …
  • Bumping a dependency or reviewing a Dependabot or Renovate pull request
  • SKILL.md covers Order of Operations, Per-Upgrade Protocol, Regression and Rollback and Verify the Claims, Don't Just…, plus 2 more sections
  • Calls git, go and npm

What it does

The skill's premise is that a version string is a claim, not a fact. The queue runs security advisories first, dev dependencies before runtime ones, minor and patch bumps batched per ecosystem, and major bumps one at a time, each with its own commit and gate run so a failure points at a single cause. Urgency such as a CVE changes the queue position but never skips a step.

Each upgrade starts by reading the changelog and breaking notes, then verifying that the target version or tag really exists: git ls-remote --tags for git refs and GitHub Actions, or the registry itself, with commands like npm view or pip index versions. For GitHub Actions it prefers resolving the verified tag to a full commit SHA and pinning that, with the version in a trailing comment, since tags can be retargeted. A cited lesson is a trivy-action pin written without the leading v, which only a live run exposed. An evals folder ships with it.

When your agent uses it

  • Bumping a dependency or reviewing a Dependabot or Renovate pull request
  • Applying a CVE-driven update without skipping the usual checks
  • Pinning a GitHub Action or git tag to a verified reference
  • Resolving a lockfile conflict during an upgrade

Example prompts

  • “Review this Renovate PR that bumps React by a major version and tell me what to check first.”
  • “Pin the GitHub Actions in our CI workflow to verified commit SHAs.”
  • “Apply the security fix for the lodash advisory and keep the other bumps out of that commit.”

Requirements

  • Network access to the package registry or git remote to verify versions

Workflow steps

4 steps, taken from the first numbered list in SKILL.md.

  1. Security advisories first. A CVE fix jumps ahead of routine bumps already in flight — patch, then resume the queue.
  2. Dev-dependencies before runtime dependencies. Lower blast radius, cheaper to revert, and they exercise the upgrade workflow before it…
  3. Minors: batch per ecosystem. One commit per ecosystem's batch of minor/patch bumps — they're supposed to be backward compatible.
  4. Majors: ONE AT A TIME. Each major version bump gets its own commit and its own full gate run. Never combine two majors in one change — if…

What it can do on your machine

Read from SKILL.md and the folder at commit 6436a20. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Shell commands in SKILL.md call:

    • git
    • go
    • npm
    • pip
    • pnpm
    • uv
    • cargo

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md. Its commands use git, npm, pip, pnpm and uv, which can reach the network depending on how they are called.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Dependency Upgrade Protocol loads about 1.5k tokens when it runs. Until then it costs about 72 tokens; SKILL.md has 852 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~72
When it runs · the whole SKILL.md, loaded when a task matches
~1.5k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

Without a licence we can't republish the file, so here is its outline and opening line. It has 852 words (~1,516 tokens).

“A version string is a claim, not a fact — verify it before you pin it. Isolate majors so a bad one is a one-line revert. Read the changelog before the diff, not after something breaks.”

— opening of SKILL.md by dralgorhythm
name
dependency-upgrade
metadata.category
encoded-preference

Read the full SKILL.md on GitHub

Files

SKILL.md and 2 other files in .claude/skills/core-engineering/dependency-upgrade of dralgorhythm/claude-agentic-framework.

  • SKILL.md
  • evals/README.md
  • evals/evals.json

Open the folder on GitHubat commit 6436a20

Compare with similar skills

Dependency Upgrade Protocol next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Dependency Upgrade Protocol compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Dependency Upgrade Protocol this skilldralgorhythm/claude-agentic-framework124—~1.5kAutomated safety check: PassNone
ZCF Release AutomationUfoMiao/zcf6.1k—~3.4kAutomated safety check: PassMIT
Sake CI Releasekattouf/Sake116—~731Automated safety check: PassMIT
Git Revert SafetyZaxbyHub/opencode-swarm488—~2.2kAutomated safety check: PassMIT
CI Triageandymai/brepjs114—~3.7kAutomated safety check: PassApache-2.0
Stash Supply Chain Securitycipherstash/stack157—~5.2kAutomated safety check: WarnMIT

Similar skills

  • ZCF Release Automation

    UfoMiao/zcf

    Automates a version release with changesets: analyzes code changes, writes a bilingual CHANGELOG, bumps the version and commits through a release branch and pull request.

    6.1k GitHub stars~3.4k tokensUpdated 1 mo ago
    DevelopmentAuto-check passed

  • Sake CI Release

    kattouf/Sake

    A skill your agent uses when working on CI workflows, GitHub Actions, release process, changelog generation (git-cliff), or dependabot configuration.

    116 GitHub stars~731 tokensUpdated 6 mo ago
    DevelopmentAuto-check passed

  • Git Revert Safety

    ZaxbyHub/opencode-swarm

    Apply when reverting commits, undoing merges, or recovering from branch contamination.

    488 GitHub stars~2.2k tokensUpdated today
    DevelopmentAuto-check passed

  • CI Triage

    andymai/brepjs

    This skill should be used when a brepjs GitHub Actions job is red or behaving oddly on github.com (a remote CI run, not a local pre-commit/pre-push hook) — "CI failed", "ci-pass is failing", "npm ci…

    114 GitHub stars~3.7k tokensUpdated today
    DevOps & CloudAuto-check passed

  • Stash Supply Chain Security

    cipherstash/stack

    Supply-chain security controls for the @cipherstash/stack monorepo.

    157 GitHub stars~5.2k tokensUpdated today
    DevelopmentAuto-check: warnings

  • Dependency Update Bot

    Varnan-Tech/opendirectory

    Scans your project for outdated npm, pip, Cargo, Go, or Ruby packages.

    672 GitHub stars~3k tokensUpdated 1 mo ago
    DevelopmentAuto-check: notes

More from dralgorhythm/claude-agentic-framework

All 20 skills in this repo

  • Swarm Coordination

    dralgorhythm/claude-agentic-framework

    Rules for several agents sharing one repository: an orchestrator tracks work in two tiers, workers write to scratch files, and every handoff leaves a pointer to an artifact.

    124 GitHub stars~1.6k tokensUpdated 2 mo ago
    Auto-check passed

  • Threat Modeling

    dralgorhythm/claude-agentic-framework

    Finds security threats in a design with a STRIDE pass per component, rates severity and records fixes, with extra checks for AI agent and tool risks.

    124 GitHub stars~581 tokensUpdated 2 mo ago
    Auto-check passed

  • Architecture Decision Record Writer

    dralgorhythm/claude-agentic-framework

    Writes Architecture Decision Records with title, status, context, decision, rationale and consequences for significant technical choices, kept short and numbered.

    124 GitHub stars~529 tokensUpdated 2 mo ago
    Auto-check passed

  • Codebase Health Auditor

    dralgorhythm/claude-agentic-framework

    Runs a user-invoked, swarm-style audit of a whole codebase for SOLID and DRY violations, code smells, complexity, dead code and pattern consistency, with a prioritized report.

    124 GitHub stars~980 tokensUpdated 2 mo ago
    Auto-check passed

  • Designing Systems

    dralgorhythm/claude-agentic-framework

    Produces this framework's ADR and system-design artifacts from bundled templates with trade-off analysis.

    124 GitHub stars~458 tokensUpdated 2 mo ago
    Auto-check passed

  • Land The Plane

    dralgorhythm/claude-agentic-framework

    Lands in-flight work: quality gates, atomic commit, rebase, push, verified remote sync, then handoff — a user-invoked finish-line workflow.

    124 GitHub stars~1.2k tokensUpdated 2 mo ago
    Auto-check passed

Works with

Categories

Questions about Dependency Upgrade Protocol

What does Dependency Upgrade Protocol do?

Sequences safe dependency upgrades: read the changelog, verify the version exists upstream, pin it, and keep major bumps in separate commits behind a full gate run. The skill's premise is that a version string is a claim, not a fact. The queue runs security advisories first, dev dependencies before runtime ones, minor and patch bumps batched per ecosystem, and major bumps one at a time, each with its own commit and gate run so a failure points at a single cause.

When should I use Dependency Upgrade Protocol?

Dependency Upgrade Protocol fits situations like: bumping a dependency or reviewing a Dependabot or Renovate pull request; applying a CVE-driven update without skipping the usual checks; pinning a GitHub Action or git tag to a verified reference; resolving a lockfile conflict during an upgrade.

How do I install Dependency Upgrade Protocol in Claude Code?

Run `npx skills add dralgorhythm/claude-agentic-framework --skill dependency-upgrade -a claude-code`. Or copy the skill folder (.claude/skills/core-engineering/dependency-upgrade in dralgorhythm/claude-agentic-framework) into .claude/skills/dependency-upgrade in your project. Claude Code loads it when a task matches its description.

How do I install Dependency Upgrade Protocol in Codex?

Run `npx skills add dralgorhythm/claude-agentic-framework --skill dependency-upgrade -a codex`. Or copy the skill folder (.claude/skills/core-engineering/dependency-upgrade in dralgorhythm/claude-agentic-framework) into .agents/skills/dependency-upgrade in your project. Codex loads it when a task matches its description.

Can I use Dependency Upgrade Protocol in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add dralgorhythm/claude-agentic-framework --skill dependency-upgrade -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/dependency-upgrade, .gemini/skills/dependency-upgrade, .github/skills/dependency-upgrade and .opencode/skills/dependency-upgrade in your project.

What does Dependency Upgrade Protocol need to run?

Going by SKILL.md and its folder, Dependency Upgrade Protocol needs the command-line tools its instructions call (git, go, npm, pip, pnpm and uv). Our summary lists: Network access to the package registry or git remote to verify versions.

Does Dependency Upgrade Protocol access the network?

SKILL.md contains no URLs. Its commands use git, npm, pip and uv, which can reach the network depending on how they are called. This is read from the text; nothing was executed.

Is Dependency Upgrade Protocol safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Dependency Upgrade Protocol use?

No licence was found for Dependency Upgrade Protocol or its repository. Without one, default copyright applies: ask the author before reusing or redistributing it.

How many tokens does Dependency Upgrade Protocol use?

About 1.5k tokens (SKILL.md is roughly 6.1k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Dependency Upgrade Protocol?

Skills that share tags, products or a category with Dependency Upgrade Protocol: ZCF Release Automation (UfoMiao/zcf, 6.1k stars), Sake CI Release (kattouf/Sake, 116 stars), Git Revert Safety (ZaxbyHub/opencode-swarm, 488 stars) and CI Triage (andymai/brepjs, 114 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Dependency Upgrade Protocol?

dralgorhythm (a GitHub user) maintains it in dralgorhythm/claude-agentic-framework, which has 124 GitHub stars. The repository holds 20 skills in this directory. The repository was last updated on July 24, 2026.

Source: dralgorhythm/claude-agentic-framework on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.