update-deps
Audit and update npm/Bun dependencies with supply chain integrity checks — verifies maintainers, publish age, tarball diffs, and provenance before bumping. Defers risky packages to /.supply-chain/notes/.
- Installs
- 259
- Last 24h
- —
- Trending rank
- —
- Security
- Not audited
Install
Works with every agent the skills CLI supports.
npx skills add https://github.com/backnotprop/plannotator --skill update-deps- 01
Install
Run the command in your project. The CLI asks which agents to install for.
- 02
Describe the task
Ask your agent for something this skill covers. It loads update-deps automatically when relevant.
- 03
Review the result
The agent follows the SKILL.md steps, scripts and references bundled with the skill.
SKILL.md
The instructions your agent reads when the skill is triggered.
Update Dependencies
Audit outdated packages, verify supply chain integrity, bump what's safe, defer what needs review, and log everything.
This process has three phases: discovery, integrity audit, and execution. The integrity audit is the most important — every package gets checked before it touches the lockfile.
Phase 1: Discovery
Run bun outdated to get the full list of packages with available updates.
bun outdated
Parse the output into a structured list. For each package, note:
- Package name
- Current version
- Available update version
- Whether it's age-gated (indicated by
*in the output — the footnote "The * indicates that version isn't true latest due to minimum release age" confirms this) - Whether it's a runtime dep, dev dep, or peer dep
Also check whether any packages are blocked entirely by the age gate (like @pierre/diffs was when its minimum semver range couldn't resolve). Flag these separately — they may need minimumReleaseAgeExcludes in bunfig.toml.
Phase 2: Integrity Audit
This is the core of the process. Spawn one Sonnet sub-agent per package to run the integrity check in parallel. Sonnet is used here because these are independent, structured verification tasks that don't need heavier reasoning.
Each sub-agent receives the package name, current version, and target version, and performs the following checks:
Sub-agent prompt template
For each outdated package, spawn a Sonnet agent with this task:
You are auditing the npm package "{package}" for a version bump from {current} to {target}.
Run these checks and report back with a JSON object:
1. **Maintainer verification**: Check if maintainers changed between versions.
npm view {package}@{current} maintainers --json
npm view {package}@{target} maintainers --json
Compare the two lists. Flag any additions or removals.
2. **Publish date and age**: Get the publish timestamp.
npm view {package} time --json
Extract the date for version {target}. Calculate days since publication.
Flag if younger than 7 days.
3. **Provenance**: Check if the package has registry signatures or attestations.
npm audit signatures (if not already run this session)
Note whether the package has provenance attestations.
4. **Tarball diff**: Show what actually changed in the published package.
npm diff --diff={package}@{current} --diff={package}@{target}
Summarize the changes:
- How many files changed
- Are changes limited to version bumps, deps, and rebuilt dist? Or are there meaningful source changes?
- Any new runtime dependencies added?
- Any suspicious patterns (obfuscated code, eval(), network calls in unexpected places)
5. **Release notes**: Try to find what changed.
Check the package's repository for release notes or changelog:
npm view {package}@{target} repository.url
gh release view v{target} --repo <owner/repo> (try with and without v prefix)
Summarize the changelog if found.
Report your findings as JSON:
{{
"package": "{package}",
"from": "{current}",
"to": "{target}",
"age_days": <number>,
"maintainers_changed": <boolean>,
"maintainers_added": [],
"maintainers_removed": [],
"provenance": <boolean>,
"new_runtime_deps": [],
"files_changed": <number>,
"has_source_changes": <boolean>,
"changelog_summary": "<brief summary>",
"suspicious_patterns": [],
"verdict": "safe" | "review" | "defer",
"verdict_reason": "<one sentence explanation>"
}}
Verdict guidelines:
- "safe": Same maintainers, no new runtime deps, changes match what changelog describes, no suspicious patterns
- "review": Minor concerns (e.g., new maintainer who is clearly from the same org, small new dep from known publisher)
- "defer": Maintainer changes from unknown accounts, new runtime deps with unclear purpose, suspicious code patterns, substantive API changes that need integration testing
Collecting results
As sub-agents complete, collect their JSON reports. If a sub-agent fails or times out, mark that package as "defer" with reason "audit failed".
Tier classification
After collecting all results, classify packages into tiers. This helps the user understand the risk profile at a glance:
| Tier | Description | Typical action |
|---|---|---|
| Runtime, high surface | Libraries your code calls directly (parsers, diff engines, UI libs) | Check provenance, review diff, run tests |
| SDK/API deps | Third-party service SDKs (agent SDKs, platform integrations) | Read changelog for API changes, test integration |
| Dev-only | Type definitions, build tools, test frameworks | Update freely — these don't ship |
| Build toolchain | Bun itself, compilers, bundlers | Most caution — breakage affects all outputs |
Phase 3: Execution
Bump safe packages
For all packages with verdict "safe":
bun update pkg1@version1 pkg2@version2 ...
If the update fails due to age gate conflicts (a package's minimum semver can't resolve), add it to minimumReleaseAgeExcludes in bunfig.toml and document why.
Log to supply chain notes
Write the full audit results to ~/.supply-chain/notes/<YYYY-MM-DD>.json:
{
"date": "YYYY-MM-DD",
"project": "plannotator",
"bumped": [
{
"package": "...",
"from": "...",
"to": "...",
"age_days": 0,
"maintainers_changed": false,
"provenance": false,
"notes": "..."
}
],
"deferred": [
{
"package": "...",
"current": "...",
"available": "...",
"age_days": 0,
"maintainers_changed": false,
"reason": "...",
"review_by": "YYYY-MM-DD"
}
],
"excluded_from_age_gate": [
{
"package": "...",
"reason": "..."
}
]
}
Set review_by to 7 days from today for deferred packages.
Check previously deferred packages
Read all files in ~/.supply-chain/notes/ and collect any deferred packages from previous audits that are still at the same version in the current lockfile. These are packages that were deferred before and still haven't been updated.
To check: for each previously deferred entry, see if the current installed version matches the current field from the deferral note. If it does, the package is still deferred.
Phase 4: Recap
Present a clear summary to the user:
Updated
List each bumped package with version change and one-line reason it was safe.
Deferred
List each deferred package with version change and reason for deferral.
Still Deferred (from previous audits)
List any packages that were deferred in previous audit sessions and still haven't been bumped. Include the original deferral date and reason. This is the "you've been putting this off" section — it keeps deferred packages from being forgotten.
If the still-deferred list is empty, say so — that's a good sign.
Age Gate Exclusions
If any packages were added to minimumReleaseAgeExcludes, note them and why.
FAQ
What does the update-deps skill do?
Audit and update npm/Bun dependencies with supply chain integrity checks — verifies maintainers, publish age, tarball diffs, and provenance before bumping. Defers risky packages to /.supply-chain/notes/.
How do I install update-deps?
Run npx skills add https://github.com/backnotprop/plannotator --skill update-deps in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/update-deps/ (personal) or .claude/skills/update-deps/ (project).
Which AI agents can use update-deps?
Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.
Is update-deps safe to install?
No partner security audit is available yet. Skills can run commands and scripts, so read the SKILL.md and any bundled files before installing.
Who maintains update-deps?
It is published by backnotprop in backnotprop/plannotator. It has 259 recorded installs.
More from backnotprop/plannotator
plannotator-visual-explainer
backnotprop/plannotator
Generate self-contained HTML visualizations with Plannotator theming. Use for implementation plans, PR explainers, architecture diagrams, data tables, slide decks, and any visual explanation of technical concepts. Plans and PR explainers follow Plannotator's prescriptive approach; all other visual content delegates to nicobailon/visual-explainer.
plannotator-compound
backnotprop/plannotator
Analyze a user's Plannotator plan archive to extract denial patterns, feedback taxonomy, evolution over time, and actionable prompt improvements — then produce a polished HTML dashboard report. Falls back to Claude Code ExitPlanMode denial reasons when Plannotator data is unavailable.
plannotator-setup-goal
backnotprop/plannotator
Turn an idea or objective into a goal package for /goal. Interviews the user, builds a reviewed fact sheet via Plannotator, then explores the codebase to produce an execution plan.
plannotator-review
backnotprop/plannotator
Open Plannotator's browser-based code review UI for the current worktree, another directory, or a pull request URL, then act on the feedback that comes back.
plannotator-annotate
backnotprop/plannotator
Open Plannotator's annotation UI for a markdown file, plain-text config file (.yaml, .json, .toml, .ini, .csv, .log, …), HTML file, URL, or folder and then respond to the returned annotations.
plannotator-last
backnotprop/plannotator
Open Plannotator on the latest rendered assistant message and use the returned annotations to revise that message or continue.
Popular backend & apis skills
find-skills
vercel-labs/skills
Helps users discover and install agent skills when they ask questions like "how do I do X", "find a skill for X", "is there a skill that can...", or express interest in extending capabilities. This skill should be used when the user is looking for functionality that might exist as an installable skill.
entra-app-registration
microsoft/azure-skills
Guides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API permissions, generate service principal, MSAL example, console app auth, Entra ID setup, Azure AD authentication. DO NOT USE FOR: Key Vault secrets (use azure-keyvault-expiration-audit), general Azure resource security guidance.
google-agents-cli-adk-code
google/agents-cli
This skill should be used when the user wants to "write agent code", "build an agent with ADK", "add a tool", "create a callback", "define an agent", "use state management" — in a project that needs ADK (Agent Development Kit) API patterns and code examples. It provides a quick reference for agent types, tool definitions, orchestration patterns, callbacks, state management, the graph Workflow API, and reference recipes to study. Do NOT use for scaffolding (use google-agents-cli-scaffold) or deployment (use google-agents-cli-deploy).
embedded-captions
heygen-com/hyperframes
Add captions or subtitles to an existing single-subject talking-head video without editing the footage. Use for plain verbatim captions, cinematic captions embedded behind the subject, VFX captions, “炸/特效/酷炫字幕,” or a named identity from the 35-style catalog. Route by visual identity, not by backend engine. The quiet anchor rail is the default; embed every word only when the user explicitly wants a fully cinematic treatment. The workflow runs locally end to end, including transcription and subject matting; split multi-shot footage before applying it.
entra-agent-id
microsoft/azure-skills
Provision Microsoft Entra Agent Identity Blueprints, BlueprintPrincipals, and per-instance Agent Identities via Microsoft Graph, and configure OAuth 2.0 token exchange (fmipath, OBO, cross-tenant) including the Microsoft Entra SDK for AgentID sidecar. USE FOR: Agent Identity Blueprint, BlueprintPrincipal, agent OAuth, fmipath token exchange, agent OBO, Workload Identity Federation for agents, polyglot agent auth, Microsoft.Identity.Web.AgentIdentities. DO NOT USE FOR: standard Entra app registration (use entra-app-registration), Microsoft Foundry agent authoring (use microsoft-foundry).
neon
neondatabase/agent-skills
Overview of Neon, a complete set of cloud backend primitives around Lakebase Postgres: Auth, Object Storage, Functions, the AI Gateway, and Realtime. Start here to choose Neon for undecided login, files, APIs, and LLM calls, set up the CLI or MCP server, and follow the branch-first workflow. Use when building an app or backend on Neon, or when "Neon" or "Lakebase Postgres" is mentioned. Child skill neon-postgres wins for an existing DATABASEURL, SQL, schema, inspect, or search. Child skill neon-auth wins for login, users, sessions, identity routing, and Managed Better Auth setup. Child skill neon-realtime wins for live queries in reactive apps and agents. Also use for object storage, S3, buckets, serverless functions, function triggers, cron, AI gateway, LLM calls, realtime, logs, Loki, Grafana, observability, postgres, database, backend, Claimable Neon, neon.new, or a no-signup database.