| name | dep-sweep |
| description | Monthly cross-repo non-security dependency freshness sweep. Bumps apps/web + packages/shared npm minor/patch (the only surfaces with no version automation), defers apps/mobile entirely to Expo's own tooling (never generic-bumps SDK-pinned packages), and reports orbit-api NuGet drift (Dependabot owns the bumps there). Runs the affected test suites and opens one PR. Use when the monthly "Dependency sweep" reminder issue fires, or when the user asks to refresh dependencies. NOT for security patches (Dependabot security updates auto-flow) and NOT for Expo SDK upgrades (use the upgrading-expo skill). |
| argument-hint | <blank = full sweep> |
Dependency Sweep
Input: $ARGUMENTS
A deliberate, human-invoked sweep of non-security version drift. Security CVEs are
already handled automatically by Dependabot security updates and are out of scope here.
The sweep is scoped by workspace, not by a hand-maintained package exclude-list —
that scoping is what makes it structurally unable to re-create the Expo whack-a-mole.
Coverage map — what this skill touches, and what it must NOT
| Surface | Action |
|---|
apps/web npm | Bump minor/patch. The Next.js surface has no version automation. |
packages/shared npm | Bump minor/patch. No native/Expo constraint. |
apps/mobile npm | NEVER bump here. Defer to npx expo install --check. These versions are SDK-owned; the only correct fix is an Expo SDK bump via the upgrading-expo skill. Report the --check verdict, change nothing. |
orbit-api NuGet | Report only. Dependabot already auto-merges minor/patch and surfaces majors as PRs. List dotnet list package --outdated + any open major Dependabot PRs for the user to review. |
| GitHub Actions (both repos) | Skip. Dependabot auto-merges these. |
Majors anywhere are listed for manual review, never auto-applied.
Procedure
1. Sync both repos to main
Fetch + fast-forward origin/main on BOTH orbit-ui-mobile and orbit-api before
inspecting anything (always investigate against updated main). If either working tree is
dirty, STOP and report — never sweep on top of uncommitted work.
2. Branch
git checkout -b chore/dep-sweep-<YYYY-MM> off the freshly-synced main in
orbit-ui-mobile. The session has no clock — take the month from the reminder issue
title, or from git log -1 --format=%cd.
3. Inventory the drift
npm outdated --json at the repo root (covers all workspaces; the dependent /
workspace path tells you which workspace each package belongs to).- Partition into: apps/web + packages/shared (sweepable), apps/mobile (hands-off,
report only), and majors anywhere (hold for review).
- In
apps/mobile: npx expo install --check — capture its verdict, act on nothing.
- In
orbit-api: dotnet list package --outdated via its absolute path.
4. Apply — web + shared, minor/patch only
Bump the sweepable packages to their latest minor/patch in the relevant package.json
files, then npm install to refresh the single root lockfile. Do not touch apps/mobile
entries. Do not apply majors.
5. Verify
npm test in apps/web and packages/shared. If a suite fails, bisect to the
offending bump, drop it from the sweep (record it as "held — broke tests"), and re-run.
Never open a PR with a red suite.
6. PR
Commit (chore: monthly dependency sweep <YYYY-MM>), push, open ONE PR against main.
Body: the bump table, the majors held for review, the apps/mobile expo install --check
verdict, and the orbit-api NuGet drift list. Close the reminder issue with a link to the
PR.
Output
A single summary: what was bumped (PR link), what was held and why (majors,
test-breakers), the mobile SDK-spec status, and the API drift list. If a major bump or
the mobile --check surfaces something that matters, call it out as a follow-up — don't
bury it.
Guardrails — do NOT
- Bump anything in
apps/mobile (expo-*, react, react-native, native transitives) —
that is the upgrading-expo skill's job, driven by the Expo SDK watcher.
- Apply major versions automatically.
- Open a PR with failing tests.
- Touch security patches — Dependabot security updates own those.
- Use
--no-verify / force-push, or sweep on a dirty tree.
