dependency-migration-triagelisted

# Dependency Migration Triage Request: **$ARGUMENTS** (a bot PR number/URL, or a dependency name + old version -> new version) You're triaging one dependency version bump. The goal is not "does it still resolve" — it's "what actually changed underneath this version number, and does anything in *this* repo need to adapt because of it." A green CI run on the bump PR itself is necessary but not sufficient: CI only proves the currently-selected checks still pass, and says nothing about whether those checks were ever capable of catching the specific thing that changed. Read `references/case-studies.md` before Phase 4 if this is your first time running this skill, or whenever a phase result feels uncertain. Its four worked examples come from a Python repo, but every lesson in it is about evidence, not about Python. Work through Phases 0-8 in order, then Phase 9 after the bump is actually merged — it is the only one that runs in a later sitting, and the one most easily lost. Scale depth to actual signal (see "Right-size the investigation" before Phase 1) — a trivial patch bump of a barely-used tool doesn't warrant the same effort as a major-version jump of something running in production, and pretending otherwise produces padded reports, not better decisions. ## Ecosystem dispatch Three phases — 0, 3 and 5/7 — are the only ones that depend on the ecosystem. Resolve them from this table, then run the phases as written. `references/ecosystems.md` has the detail, the traps, and t