Best dependency management skills, page 3

Workflow for updating gem dependencies and fixing CVEs in the ruby-git project: assess with bundle outdated and audit, edit the gemspec, test, then commit with conventional messages.

ruby-git/ruby-git

Albucore image processing conventions - shapes (H,W,C), dtypes (uint8/float32), benchmark-driven backend routing (OpenCV, NumPy, Torch CPU, LUT, NumKong), tests, and lockfile discipline.

albumentations-team/albucore

Process the oldest open pull request end-to-end: analyze the diff, add missing tests on that PR branch, resolve review comments (including Copilot) in a loop, fix test regressions, update…

itgalaxy/webfont

Package and publish Python libraries and CLI tools: project layout, pyproject.toml, build backends, wheels and source distributions, versioning and PyPI releases.

wshobson/agents

Review and merge open dependency pull requests from Dependabot, Renovate and similar bots across the goreleaser organization and the caarlos0 user.

caarlos0/dotfiles

Audit open dependabot PRs in this repo. An agent skill from garfiec/Librechat-Mobile.

garfiec/Librechat-Mobile

Sets up and maintains AzureML-ready Python projects as uv workspaces with devcontainers, a Makefile and job YAML, so local runs match cloud jobs and experiments stay reproducible.

Kilo-Org/kilo-marketplace

Triage a CVE / Dependabot alert in a JS/TS project and recommend the least-invasive fix.

getlago/lago-front

Route code and dependency changes to relevant review dimensions based on affected files and folders.

microsoft/vstest

Snapshot the computational environment for a replication package — detects the analysis stack (R / Stata / Python) and emits the right lockfiles (renv.lock + sessionInfo.txt, requirements.txt /…

pedrohcgs/claude-code-my-workflow

Fix a PR that is failing due to security or vulnerability issues — npm/pnpm/yarn/bun audit failures, CVE alerts, Dependabot merge conflicts, Snyk failures, or GitHub security advisory blocks.

unional/typescript-blackbook

Upgrades every package under ./examples to the repository's latest signals version, runs pub upgrade on third-party dependencies, and fixes the resulting analysis problems.

rodydavis/signals.dart

An extremely strict maintainability review for abstraction quality, giant files, and spaghetti-condition growth.

diyanbogdanov/emend

Quick reference for using Bun to run TypeScript and JavaScript, install packages, bundle code, run tests and serve HTTP, with the key files and commands.

mweinbach/agent-coworker

Recreates every Flowfile development and build environment from scratch, with exact version pins and an explanation of what each Makefile target really does.

Edwardvaneechoud/Flowfile

Add or manage third-party dependencies in a Polylith workspace.

DavidVujic/python-polylith

Aligns a Lens extension's package.json ranges with the dependency versions bundled in the running Lens build, then reinstalls and rebuilds.

nevalla/lens-resource-map-extension

Audit SkiaSharp's native dependencies for security vulnerabilities and CVEs, including Component Governance (CG) alerts from the combined skiasharp-package Azure DevOps pipeline.

mono/SkiaSharp

A skill your agent uses when updating dependencies managed by uv: bumping a package version, upgrading the uv tool itself, updating torch/CUDA stack, switching transformers version, or regenerating…

ByteDance-Seed/VeOmni

A checklist for upgrading the pinned ONNX version and opset in ONNX Runtime, covering the files to change, archive hashes, patch rebasing and release-candidate handling.

microsoft/onnxruntime

Hermetic Rust crate building, testing, and formatting via Bazel targets.

Moosync/Moosync

Conventions for adding packages and apps to a TypeScript monorepo: project references, moon tasks, workspace dependencies and published package exports.

pierrecomputer/pierre

Explains how changes to the Flowfile monorepo are gated, versioned and released, including version sync, stub and docs drift checks, Alembic migrations and pinned dependencies.

Edwardvaneechoud/Flowfile

Keep dependencies up-to-date. An agent skill from github/rust-gems.

github/rust-gems

Scans a repository, its lockfiles and node_modules for known malicious npm package versions and install-time indicators, using a read-only Python scanner.

majiayu000/spellbook

Check dependencies for known vulnerabilities using npm audit, pip-audit, etc.

alirezarezvani/claude-code-tresor

Automated triage and fixing of Dependabot security vulnerabilities (IN-1189).

linuxfoundation/insights

Guides Gradle 9 build changes in apache/grails-core on the 8.0.x line, favoring the repo's convention plugins, BOM platforms and patterns over generic Gradle advice.

apache/grails-core

Bumps an existing Python dependency in getsentry/sentry through the repository's self-serve GitHub Actions workflow.

getsentry/sentry

Handle open dependabot PRs automatically. An agent skill from EmertonData/glide.

EmertonData/glide

What a dependency migration must do before it is finished, regardless of how good the code is.

diyanbogdanov/emend

Current Bun workspace guidance for isolated and hoisted linkers, catalogs, filters, scripts, dependency classes, lockfiles, lifecycle trust, caches, publishing, TypeScript package exports, and…

shepherdjerred/monorepo

Sets ground rules for a coding agent that edits its own Rust source: read the code and journal first, write tests first, commit small changes and check compilation after each file.

yologdev/yoyo-evolve

Audits a project's dependencies for supply-chain risk: version-matched advisories for direct dependencies and the full lockfile tree, abandoned or archived upstreams, npm publisher concentration…

trailofbits/skills

Guide for safely updating project dependencies. An agent skill from microsoft/haste.

microsoft/haste

Read the vendor's breaking changes, deprecations, migration notes and CVEs for every version between the one pinned now and the one being moved to, through the whatsnew MCP server's upgradenotes tool.

getknit/knit

Checks that the tools and Python packages needed for a math modeling paper workflow are installed and offers platform-specific install commands for anything missing.

jihe520/MathModelAgent

A skill your agent uses when publishing or preparing to publish an npm package from this repository, especially the Skill Zoo CLI package under packages/cli.

luochang212/skill-zoo

Guides moving a Grails application from 7.x to Grails 8 and turns the official upgrade guide into a checklist of breaking changes.

apache/grails-core

Create batched Dependabot-style pull requests for GitHub security findings in axelixlabs/axelix, grouped by dependency surface such as master/front-end, master/build.gradle.kts, or starter Gradle…

axelixlabs/axelix

A skill your agent uses when the user mentions a Dotty PR, dotty (package/dependency) updates, or asks to update the .NET agent compatibility docs / net-agent-compatibility-requirements after tested…

newrelic/newrelic-dotnet-agent

Use after Phase 1 dependency updates are merged, before any Phase 2 propagation to sibling forks - runs the end-to-end devnet gate (up brings devnet/deploy/dev-server up, verify drives Chrome over…

Scaffold-Stark/scaffold-stark-2

Finds two or three well-maintained npm packages for a Front-End Checklist rule, checks download and release thresholds, and adds them to the rule's frontmatter.

thedaviddias/Front-End-Checklist

Fix a Renovate dependency-update PR with the minimal compatible code adaptation, extracting a dependency bump from a grouped PR only when the fix requires the new version.

mui/mui-public

Conventions for .mjs files in the Handsontable monorepo: native node: imports, top-level await, the tasks.json dispatcher and native modules instead of extra dependencies.

handsontable/handsontable

Keeps Ansible install tasks in line with upstream docs by fixing version, install-method and link drift one tool at a time, with a commit for each.

vinta/hal-9000

Moves a Node.js, npm, Yarn, pnpm or Bun project to Deno in reversible steps, starting with Deno as the package manager and changing no code unless needed.

denoland/skills

Updates the biome package across a monorepo with pnpm, renames and realigns biome.jsonc schema versions, then runs lint fixes.

prisma/orm