| name | upgrade-deps |
| description | Upgrade dependency versions and lockfiles across npm workspaces, Python uv projects, and GitHub Actions when asked to bump, upgrade, or update dependencies. |
| argument-hint | [major|minor|patch] [--npm|--python|--actions] |
Context
Current branch: !git branch --show-current 2>/dev/null || echo "(unknown)"
Uncommitted changes: !git status --short 2>/dev/null || echo "(unable to read status)"
JavaScript lockfile: !for f in pnpm-lock.yaml yarn.lock package-lock.json bun.lock bun.lockb; do if test -f "$f"; then echo "$f"; exit 0; fi; done; echo "(none)"
Root dependency scripts: !test -f package.json && jq -r '.scripts // {} | [to_entries[] | select(.key | test("dep|upgrade|update|taze"; "i")) | "\(.key): \(.value)"] | if length == 0 then ["(none)"] else . end | .[]' package.json 2>/dev/null || echo "(none)"
uv.lock files: !find . -name node_modules -type d -prune -o -name uv.lock -print 2>/dev/null | head -20 || echo "(none)"
Changesets: !test -d .changeset && echo "yes (.changeset/)" || echo "(none)"
Dependabot or Renovate config: !find . -name node_modules -type d -prune -o \( -path './.github/dependabot.yml' -o -path './.github/dependabot.yaml' -o -name renovate.json -o -name .renovaterc -o -name .renovaterc.json \) -print 2>/dev/null | head -20 || echo "(none)"
GitHub Actions workflows: !test -d .github/workflows && find .github/workflows -maxdepth 1 -type f \( -name '*.yml' -o -name '*.yaml' \) -print 2>/dev/null | head -20 || echo "(none)"
Instructions
Upgrade every detected ecosystem's dependencies, regenerate lockfiles, validate with the repository's own checks, report the result, and never commit.
Process
- Parse
$ARGUMENTS (bump level is major, minor, or patch, defaulting to major; --npm, --python, and --actions limit scope, otherwise process every detected ecosystem).
- Abort with a message if the working tree is dirty. If the current branch is the default branch, run
git checkout -b chore/upgrade-deps before modifying files.
- Prefer convention. When the root
package.json contains a repository-native dependency preview and update pair, such as deps:check and deps:update, run them via the package manager detected from the lockfile, preview first, then update, and skip the generic npm recipe. Otherwise follow references/npm.md.
- After every blanket npm bump, apply each matching SDK repin in references/npm.md. Blanket bumpers do not know SDK compatibility matrices, so a package governed by one must be restored to its compatible dependency line before validation.
- For each directory with
uv.lock, run uv lock --upgrade && uv sync, then run uv run pytest when tests exist. Do not create a changeset for Python: uv lock --upgrade changes locked transitive dependencies, while a published Python package's own version is a separate release decision.
- Skip GitHub Actions updates entirely, and say why in the report, when a Dependabot or Renovate configuration exists. Otherwise run
ratchet pin .github/workflows/*.{yml,yaml}, then ratchet update .github/workflows/*.{yml,yaml}; keep every trailing # vN comment intact. On a major jump, read the action's release notes because ratchet does not identify breaking changes. If ratchet is unavailable, update each uses: SHA and its version comment together manually.
- Run the repository's own available validation scripts, including build, lint, and test checks. When a package fails after a major bump, pin that one dependency back in its
package.json, reinstall, and record the reason in the report.
- Create a changeset only when
.changeset/ exists. Use the repository's changeset-generation script when available. Otherwise, identify changed package.json files with git diff HEAD before any commit, skip packages with private: true, and write one patch changeset in the repository's established format for the remaining published packages. Never hand-edit bump levels generated by a script.
- Leave a validated, uncommitted working tree and report each ecosystem: bumped dependencies with notable majors, dependencies pinned back and why, and work skipped and why. Committing composes
commit-changes; driving the work to a merged PR composes ship-pr.
Rules
- A large lockfile diff after full regeneration is expected; do not treat it as an error.
- Never weaken or delete failing tests to make validation pass.
