Best dependency management skills for Claude Code, Codex and other agents.

Bumps the pinned v8 and rusty_v8 versions in Codex, validates the release-candidate path with the v8-canary check, and traces failures to upstream build changes.

openinterpreter/openinterpreter

Plan and apply Go dependency updates, including advisory-driven bumps, Trivy/govulncheck validation, and supply-chain review.

trufflesecurity/trufflehog

Walks through adding a new text-to-speech engine to Voicebox end to end: dependency audit, backend, frontend wiring, PyInstaller bundling and frozen-build testing.

jamiepine/voicebox

Triages and lands a batch of open Dependabot PRs in the Onyx repo, where main is gated exclusively by GitHub's merge queue: approves and enqueues green PRs, closes superseded duplicates, fixes…

onyx-dot-app/onyx

Comprehensive software architecture skill for designing scalable, maintainable systems using ReactJS, NextJS, NodeJS, Express, React Native, Swift…

maslennikov-ig/claude-code-orchestrator-kit

Audits and updates os-packages.json files listing the Linux packages each .NET release needs per distro, then regenerates the Markdown from the JSON.

dotnet/core

Work on the pnpm Rust engine (@pnpm/napi, the pacquet crates) that bit install runs through.

teambit/bit

Sets up an isolated Python environment with a supported interpreter and current boto3 before any SageMaker deployment, training or AWS automation code runs.

huggingface/skills

Workflow rules for the Ghostty submodule in cmux: rebuilding GhosttyKit.xcframework, pushing fork changes and updating the parent submodule pointer safely.

manaflow-ai/cmux

Walks maintainers through bumping the pinned validator package in express-validator and syncing chain types, implementations and options with the new release.

express-validator/express-validator

Gives repository-specific .NET guidance for GitVersion: build and test commands, central package management, project layout and coding conventions.

GitTools/GitVersion

Inventories and maintains a fleet of Macs from a desired-state file: package updates, repo and Xcode sync, and disk, backup and security health reports.

steipete/agent-scripts

Walks an agent through working inside the Megatron-LM CI container and changing dependencies with uv, so lock files resolve the same locally and in CI.

NVIDIA/Megatron-LM

Updates the obs-multi-rtmp plugin repo to the latest upstream plugin template and OBS Studio version, including dependency metadata, then rebuilds it with CMake.

sorayuki/obs-multi-rtmp

Recommends whether to stay on the installed Claude Code version, update, or pin another one by comparing npm tags, release timing and the changelog.

ykdojo/claude-code-tips

Creates Python projects with proper structure, virtual environments, and dependency management.

haddock-development/claude-reflect-system

A skill your agent uses when: retrieving, exporting, triaging, or remediating Azure DevOps Component Governance alerts for this repository, including CG report URLs, vulnerable pnpm dependencies…

OfficeDev/microsoft-365-agents-toolkit

Moves Megatron-LM CI to a newer NVIDIA PyTorch base image, updating both the GitHub and GitLab pins together and handling the CI follow-up.

NVIDIA/Megatron-LM

Manage major dependency version upgrades with compatibility analysis, staged rollout, and comprehensive testing.

sangrokjung/claude-forge

Installs, repairs and starts a local source checkout of FireRed-OpenStoryline, from prerequisites and a venv to resources, config and the MCP and web servers.

FireRedTeam/FireRed-OpenStoryline

Audit, plan, and refresh dependency upgrades for the Logseq repository by scanning every non-gitignored package.json, deps.edn, bb.edn and nbb.edn manifest, checking latest upstream versions…

logseq/logseq

Fixes GN dependency errors in WebRTC BUILD.gn files with the gn_check_autofix.py script, including missing deps and misused rtc_source_set targets.

webrtc-sdk/webrtc

Smart dependency management for any language. An agent skill from Asvarox/allkaraoke.

Asvarox/allkaraoke

Upgrades a pinned agent SDK in the agor project, such as the Claude, Codex or Gemini CLI one, and plans the release that carries it to packaged installs.

preset-io/agor

Translate every dirty ArcReel documentation source into English and refresh the translation lockfile.

ArcReel/ArcReel

Update native dependencies (libpng, libexpat, zlib, libwebp, harfbuzz, freetype, libjpeg-turbo, etc.) in SkiaSharp's Skia fork.

mono/SkiaSharp

Bun as runtime, package manager, bundler, and test runner. An agent skill from spinspire/pocketbase-sveltekit-starter.

spinspire/pocketbase-sveltekit-starter

Syncs or audits ccLoad's CLIProxyAPI protocol-conversion core and registered provider adapters against one pinned upstream commit, then verifies the result.

caidaoli/ccLoad

Master the uv package manager for fast Python dependency management, virtual environments, and modern Python project workflows.

Yikai-Liao/symusic

Reviews Renovate pull requests that bump GitHub Actions by checking pinned SHAs against upstream tags, scanning changelogs and confirming workflows stay compatible.

backnotprop/plannotator

Analyzes a Rails app and builds an upgrade report with breaking changes, deprecations and step-by-step migration guides, one version at a time from Rails 2.3 through 8.1.

ombulabs/claude-code_rails-upgrade-skill

A skill your agent uses to validate risky dependency bumps end to end as a local or cloud-launched agent.

blokadaorg/blokada

Safely plan and execute dependency maintenance for JavaScript/TypeScript (npm, pnpm) and GitHub Actions, including npm lockfiles, pnpm workspaces, catalogs, overrides, SHA-pinned action versions…

Consensys-Incorporated/linea-attestation-registry

Append GitHub Dependabot or Snyk/code-scanning alerts to an existing vulnerability CSV after verifying their API metadata.

langfuse/langfuse

Manages Node.js dependencies, scripts and installs with aube, aubr and aubx, choosing the right command by its effect and preserving the project's existing lockfile and workspace format.

aubepkg/aube

Audit or harden gocron security across Go, pnpm workspaces, containers, authentication, authorization, secrets, command execution, SSRF, and dependency vulnerabilities.

gocronx-team/gocron

Advances RStudio's pinned copilot-language-server dependency to a specified release, then uploads it to S3, verifies the install, and opens a PR.

rstudio/rstudio

Upgrade all or selected NuGet packages in net-daemon/netdaemon with dotnet-outdated, validate the full solution, and optionally publish a dependency-update PR with gh-axi.

net-daemon/netdaemon

Cargo.toml dependency management patterns for HASH workspace.

hashintel/hash

Picks the next CPython standard library module ready for a RustPython upgrade, skipping modules that already have an open upgrade pull request.

RustPython/RustPython

Check if recent cybersecurity alerts from 10 international CERTs affect your current project.

karimhabush/cyberowl

Assesses what an API change would break before it is made, finds every usage, documents the impact and plans a deprecation or migration path.

ruby-git/ruby-git

Updates the Databricks CLI's cli-compat.json with new AppKit and Agent Skills versions and opens a pull request for the change.

databricks/cli

Creates and maintains the per-distro JSON files that list the native packages .NET needs on each Linux distribution, scoped to one .NET version.

dotnet/core

Bumps the pinned Electron version across the RStudio repository, updating NEWS.md, package.json, the lockfile and the allowScripts entry.

rstudio/rstudio

Check if package.json files are in sync with pnpm-lock.yaml.

Hyk260/PureChat

Adds support for a new Laravel major to a package by extending composer.json constraints for illuminate, Testbench and Pest and the CI test matrix.

mailcarrierapp/mailcarrier

Automatically fetch and fix Dependabot security alerts by querying GitHub REST API for open alerts, identifying vulnerable packages, researching secure versions, and updating package.json files…

livesession/xyd