awesome-dependency-upgradelisted

# Dependency Upgrade Execute dependency upgrades so that each step is verified and each batch is revertable. The failure mode this skill exists to prevent: a bulk bump to `latest`, a green-looking build, and a runtime break three days later that `git bisect` can't isolate because fifteen packages moved in one commit. ## When to Activate - "Upgrade/update dependencies", "bump X to v9", "fix `npm audit`", a bot PR needs handling. - An awesome-dependency-audit report produced findings to remediate — this skill is its acting half. Do not activate to decide *whether* a package is risky (the audit owns detection) or to add a new dependency (ask-first, outside both skills). ## Work Process 1. Inventory before touching — for each candidate: current resolved version (lockfile, not manifest), target version, direct or transitive, and why it's moving (security fix, feature need, hygiene). No reason → it waits; churn is not hygiene. 2. Classify by risk and batch accordingly — lockfile-only refreshes and patch/minor bumps of well-locked packages batch together; every major goes alone, one at a time. Security-driven bumps jump the queue but follow the same verification. 3. One upgrade concern per commit — never mix an upgrade with feature work or refactoring; the commit message names what moved and why. A batch is one revertable unit: if it breaks, one `git revert` restores the world. 4. Majors are changelog-driven, not semver-trusted — read the release notes and migration guide for