Update Deps

Update Dependencies

Automate the full dependency update lifecycle: discover what's outdated, apply updates grouped by ecosystem, fix breakage, get CI green, and hand off for human review.

Repository context

This is a Rust workspace containing utility crates published to crates.io. All dependency update PRs target the main branch.

Dependabot is configured (.github/dependabot.yaml) to open PRs against main on the 2nd of each month. This skill gathers individual dependabot PRs, combines updates by ecosystem, fixes any breakage, gets CI green, and creates consolidated PRs for human review.

Crates in this workspace

Supporting packages (not published): bpe-tests, bpe-benchmarks.

Ecosystems in this repo

Build and validation commands

make build     # cargo build --all-targets --all-features
make build-js  # npm run compile in crates/string-offsets/js
make lint      # cargo fmt --check + cargo clippy (deny warnings, forbid unwrap_used)
make test      # cargo test + doc tests

CI runs on ubuntu-latest with the mold linker. The lint job depends on build.

Workflow

1. Assess repo state

Determine the repo identity and confirm the target branch.

git remote get-url origin   # extract owner/repo
git fetch origin main
git rev-parse --verify origin/main

Detect which ecosystems have pending updates:

[ -f Cargo.toml ] && echo "cargo"
ls .github/workflows/*.yml .github/workflows/*.yaml 2>/dev/null && echo "github-actions"
[ -f crates/string-offsets/js/package.json ] && echo "npm"

Report discovered ecosystems to the user.

2. Gather dependency intelligence

Fetch open dependabot PRs:

gh pr list --author 'app/dependabot' --base main --state open --json number,title,headRefName,labels --limit 100

Fetch open dependabot alerts:

gh api --paginate /repos/{owner}/{repo}/dependabot/alerts --jq '[.[] | select(.state=="open") | {number: .number, package: .security_vulnerability.package.name, ecosystem: .security_vulnerability.package.ecosystem, severity: .security_advisory.severity, summary: .security_advisory.summary}]'

For ecosystems without dependabot coverage or when running ad-hoc, use native tooling:

• cargo: cargo update --dry-run
• npm: find directories containing package.json, then run npm outdated --json || true in each (npm exits non-zero when updates exist)

Also fetch the advisory URLs for any security-related updates. Individual alert details are at https://github.com/{owner}/{repo}/security/dependabot/{alert_number}. Fetch alert numbers and GHSA IDs via:

gh api --paginate /repos/{owner}/{repo}/dependabot/alerts --jq '[.[] | {number: .number, state, package: .security_vulnerability.package.name, ecosystem: .security_vulnerability.package.ecosystem, severity: .security_advisory.severity, ghsa_id: .security_advisory.ghsa_id, summary: .security_advisory.summary}]'

Include both open and auto_dismissed/dismissed alerts — the update may resolve alerts in any state.

Cross-reference and group all updates by ecosystem. Present a summary to the user:

• How many updates per ecosystem
• Which have security alerts (with severity, GHSA IDs, and advisory links)
• Which dependabot PRs already exist

Flag high-risk upgrades. Before proceeding, explicitly call out upgrades that carry elevated risk:

• Major version bumps — likely contain breaking API changes
• Packages with wide blast radius — for this repo, pay special attention to: serde, itertools, regex-automata, wasm-bindgen, criterion, and the Rust toolchain itself
• Multiple major bumps in the same PR — each major bump multiplies the risk; consider splitting them

Present the risk assessment to the user and recommend which upgrades to include vs. defer. When in doubt, prefer a smaller, safe update over an ambitious one that might break.

3. Create branch and apply updates

For each selected ecosystem, starting from main:

git checkout main
git pull origin main
git checkout -b deps/{ecosystem}-updates-$(date +%Y-%m-%d)

Apply updates using ecosystem-appropriate tooling:

cargo:

cargo update
# For major bumps, edit Cargo.toml version constraints then:
cargo check

This is a Cargo workspace — always run from the repo root. All crate Cargo.toml files are in crates/. The Cargo.lock at the root is the single source of truth.

npm:

cd crates/string-offsets/js
npm update
npm install

github-actions:

• Parse workflow YAML files in .github/workflows/ for uses: directives
• For each action with an outdated version (from dependabot PRs/alerts), update the SHA or version tag
• Be careful to preserve comments and formatting

4. Build, lint, and test locally

Always run:

make lint      # cargo fmt --check + clippy with deny warnings
make test      # cargo test with backtrace
make build     # full workspace build (all targets, all features)

If npm dependencies changed:

make build-js  # npm compile for string-offsets JS binding

If the build/lint/test fails:

1. Read the error output carefully
2. Analyze what broke — likely API changes, type errors, or deprecation removals
3. Make the necessary code changes to fix the breakage
4. Run the pipeline again
5. Repeat up to 3 times

If still failing after 3 iterations, report the situation to the user and ask for guidance. Do not push broken code.

5. Commit and push

Stage all changes and commit with a descriptive message:

git add -A
git commit -m "chore(deps): update {ecosystem} dependencies

Updated packages:
- package-a: 1.0.0 → 2.0.0
- package-b: 3.1.0 → 3.2.0

{If code changes were needed:}
Fixed breaking changes:
- Updated X API usage for package-a v2

Supersedes: #{dependabot_pr_1}, #{dependabot_pr_2}
"

Push the branch:

git push -u origin HEAD

6. Create the PR

Title: chore(deps): update {ecosystem} dependencies

Body should include:

• List of updated dependencies with version changes (old → new)
• Any security alerts resolved — for each, link to the specific dependabot alert (https://github.com/{owner}/{repo}/security/dependabot/{alert_number}) and the GHSA advisory (https://github.com/advisories/GHSA-xxxx-xxxx-xxxx), along with severity and summary
• High-risk changes flagged for reviewer attention (major version bumps, wide-blast-radius packages)
• Code changes made to fix breakage (if any)
• References to superseded dependabot PRs
• Note that this was generated by the update-deps skill

Write the body to a temp file and create the PR targeting main:

gh pr create --title "chore(deps): update {ecosystem} dependencies" --body-file /tmp/deps-pr-body.md --base main
rm /tmp/deps-pr-body.md