dependency-upgradelisted

# Dependency Upgrade <!-- routing-eval reads this line; it lives in the BODY so the always-on skill LISTING stays inside Claude Code's budget (1% of the context window) — an overflowing listing gets descriptions truncated or dropped, which strips the very keywords a match depends on. --> Trigger phrases: "upgrade dependencies", "outdated packages", "bump versions", "update packages", "keep dependencies current" ## When Staying on current versions as an ongoing practice, or reacting to a CVE. [[dependency-audit]] tells you what is wrong; this decides what to do about it and does it. It **mutates the manifest and the lockfile**, so it carries the same shape as [[db-migration]]: detect the tool, classify by risk, gate the dangerous class behind approval, apply, verify, roll back on red. ## 1 — Ask the three separate questions They are three different problems with three different answers, and the tooling keeps them separate too. | Question | Node | .NET | Python | |---|---|---|---| | What has a **known CVE**? | `npm audit --json` | `dotnet list package --vulnerable` | `pip-audit` | | What is **deprecated**? | `npm view <pkg> deprecated` | `dotnet list package --deprecated` | registry / project notes | | What is simply **behind**? | `npm outdated --json` | `dotnet list package --outdated` | `pip list --outdated` | > The three `dotnet list package` flags **cannot be combined** — it is three separate runs, not one. **Deprecated is not an upgrade.** No version bump f