upgrade-deps

name	upgrade-deps
description	Upgrade dependency versions and lockfiles across npm workspaces, Python uv projects, and GitHub Actions when asked to bump, upgrade, or update dependencies.
argument-hint	[major|minor|patch] [--npm|--python|--actions]

Context

Current branch: !git branch --show-current 2>/dev/null || echo "(unknown)"

Uncommitted changes: !git status --short 2>/dev/null || echo "(unable to read status)"

JavaScript lockfile: !for f in pnpm-lock.yaml yarn.lock package-lock.json bun.lock bun.lockb; do if test -f "$f"; then echo "$f"; exit 0; fi; done; echo "(none)"

Root dependency scripts: !test -f package.json && jq -r '.scripts // {} | [to_entries[] | select(.key | test("dep|upgrade|update|taze"; "i")) | "\(.key): \(.value)"] | if length == 0 then ["(none)"] else . end | .[]' package.json 2>/dev/null || echo "(none)"

uv.lock files: !find . -name node_modules -type d -prune -o -name uv.lock -print 2>/dev/null | head -20 || echo "(none)"

Changesets: !test -d .changeset && echo "yes (.changeset/)" || echo "(none)"

Dependabot or Renovate config: !find . -name node_modules -type d -prune -o \( -path './.github/dependabot.yml' -o -path './.github/dependabot.yaml' -o -name renovate.json -o -name .renovaterc -o -name .renovaterc.json \) -print 2>/dev/null | head -20 || echo "(none)"

GitHub Actions workflows: !test -d .github/workflows && find .github/workflows -maxdepth 1 -type f \( -name '*.yml' -o -name '*.yaml' \) -print 2>/dev/null | head -20 || echo "(none)"

Instructions

Upgrade every detected ecosystem's dependencies, regenerate lockfiles, validate with the repository's own checks, report the result, and never commit.

Process

1. Parse $ARGUMENTS (bump level is major, minor, or patch, defaulting to major; --npm, --python, and --actions limit scope, otherwise process every detected ecosystem).
2. Abort with a message if the working tree is dirty. If the current branch is the default branch, run git checkout -b chore/upgrade-deps before modifying files.
3. Prefer convention. When the root package.json contains a repository-native dependency preview and update pair, such as deps:check and deps:update, run them via the package manager detected from the lockfile, preview first, then update, and skip the generic npm recipe. Otherwise follow references/npm.md.
4. After every blanket npm bump, apply each matching SDK repin in references/npm.md. Blanket bumpers do not know SDK compatibility matrices, so a package governed by one must be restored to its compatible dependency line before validation.
5. For each directory with uv.lock, run uv lock --upgrade && uv sync, then run uv run pytest when tests exist. Do not create a changeset for Python: uv lock --upgrade changes locked transitive dependencies, while a published Python package's own version is a separate release decision.
6. Skip GitHub Actions updates entirely, and say why in the report, when a Dependabot or Renovate configuration exists. Otherwise run ratchet pin .github/workflows/*.{yml,yaml}, then ratchet update .github/workflows/*.{yml,yaml}; keep every trailing # vN comment intact. On a major jump, read the action's release notes because ratchet does not identify breaking changes. If ratchet is unavailable, update each uses: SHA and its version comment together manually.
7. Run the repository's own available validation scripts, including build, lint, and test checks. When a package fails after a major bump, pin that one dependency back in its package.json, reinstall, and record the reason in the report.
8. Create a changeset only when .changeset/ exists. Use the repository's changeset-generation script when available. Otherwise, identify changed package.json files with git diff HEAD before any commit, skip packages with private: true, and write one patch changeset in the repository's established format for the remaining published packages. Never hand-edit bump levels generated by a script.
9. Leave a validated, uncommitted working tree and report each ecosystem: bumped dependencies with notable majors, dependencies pinned back and why, and work skipped and why. Committing composes commit-changes; driving the work to a merged PR composes ship-pr.

Rules

• A large lockfile diff after full regeneration is expected; do not treat it as an error.
• Never weaken or delete failing tests to make validation pass.