Agent skill · Supply chain
Dependency updates pile up because each one is a small risk: a breaking change, or a poisoned release from a hijacked account. Update dependencies is a free skill for Claude Code and Codex that does the boring part across all your repositories: it waits a week before taking a release, reads what was actually published, migrates what breaks, runs your checks, and writes down why it did or did not upgrade.
New releases are the riskiest ones. Attacks on npm publish poisoned versions of popular packages and count on everyone pulling them within hours. A short wait is the cheapest defense: npm can enforce it with min-release-age, and Dependabot with a cooldown.
A version number says nothing about the code. The skill downloads both versions from the registry, checks them against the published integrity hash, and compares them: new install scripts, native binaries, obfuscated code, new reads of tokens, a different publisher, a lost provenance attestation, a license change.
Tags move. GitHub recommends pinning actions to a full commit SHA, and Docker image tags change under you too. The skill pins both and keeps the version next to the pin so you can still read it.
Bots open a pull request per package and stop at a red build. Majors need someone to read the migration guide and change the code. That is the part the agent does here.
/update-dependencies with no arguments goes over every repository it knows. The first run finds your git repositories and what they use: npm projects, Node.js versions, Dockerfiles, GitHub Actions, Python pins, Xcode packages and pods.
For each dependency: the newest stable release at least 7 days old, never lower than what is installed. Repositories with uncommitted work are skipped, and your holds and notes in ~/dependencies/settings.json are respected.
npm upgrades are diffed tarball against tarball and checked against the registry hash. Changelogs and migration notes are read for majors. Anything suspicious is held and reported instead of installed.
Majors go through codemods and the migration guide. Then your own checks run: typecheck, tests, lint, build. A change that cannot pass is rolled back with the reason.
A write-ahead log makes interrupted runs recoverable. Each repository gets a readable log of what was planned, reviewed, applied, held and verified. Changes stay in your working tree.
Shortened. Example input and output.
/update-dependencies32 repositories, 89 npm projects, 9 workflows, 3 Dockerfiles web: vite 6.4.1 → 7.2.2 (major, migrated: config moved to defineConfig), 14 minor and patch updates, checks passed api: some-lib 2.9.0 → 3.0.0 held: license changed from MIT to BUSL-1.1 site: actions/checkout v4 → 3d3c42e… # v7.0.1, FROM node:22 → node:26.13.0-bookworm-slim@sha256:… docs: skipped, uncommitted changes Log: ~/dependencies/repos/<repo>/log.md
The skill is what one long day of upgrading my own repositories turned into, on November 3, 2026: React 17 to 19, ESLint 7 to 10, Babel 8, three.js r170 to r186, the Anthropic SDK 1.x, and npm audit down to zero in 24 of 26 repositories.
The same day showed why the checks exist. A plain ^ range pulled wrangler 4.157, released hours earlier, into 22 lockfiles. A vendored SDK turned out to be built from a transitive package one day old. Both rules, a week of waiting for every package and a lockfile check after every install, are now part of every run.
Pick the place you already work in. Every option installs the same open-source skill. Needs Claude Code or Codex with a shell, Node 20 or later, git, npm 11.10 or later for min‑release‑age, and network access to the package registries. Set GITHUB_TOKEN for a higher GitHub API limit.
Inside a session: add the marketplace, install the pack, reload. The pack also brings the other skills.
/plugin marketplace add Ciunkos/skills/plugin install ciunkos@ciunkos/reload-plugins/update-dependenciesClone the repository and symlink the skill into ~/.agents/skills. Start a new session and call it with $update-dependencies.
git clone https://github.com/Ciunkos/skills ~/ciunkos-skills
mkdir -p ~/.agents/skills
ln -s ~/ciunkos-skills/skills/update-dependencies ~/.agents/skills/update-dependenciesDoes not run in claude.ai, ChatGPT.
Done for you
I keep client projects up to date the same way: upgrades reviewed before they land, majors migrated, checks green. Or I help you set up tests first, so updates can be verified at all.
One short email when a new skill ships or one changes a lot. No newsletter, no sales sequence.
Done. The next skill lands in your inbox. Every email has a one‑click unsubscribe.
That did not work. Check the address and try again in a minute.
Prefer GitHub? Watch the repository for releases.
FAQ
~/dependencies. What happens next is up to you.~/dependencies/settings.json, for example "some-lib": { "hold": "<3.0.0", "reason": "3.0 changed the license" }. Notes in plain words work too; the agent reads them before planning.--ignore-scripts, and new or changed install scripts in a release are one of the signals that hold an upgrade.Checked on October 26, 2026.
You bring the problem, I bring the questions. Want a number first? The configurator shows hours, a price range and the start date.
or write to ciunkos@gmail.com
After you book you get a calendar invite. Nothing else to fill in.
My pledge
Calls this week · work starts 3 November 2026 · B2B contract · Wrocław, Poland (CET), remote
You own the code, domain and accounts from day one. Nothing is held hostage.