package-updater-updating-packageslisted

# Updating packages Find what is actually out of date, research each move against the vendor's own release notes, and land it as commits that separate the toolchain from the dependencies from their fallout. Six references carry the parts that must not drift between this skill and the plugin's commands: - `references/repo-scope.md` — deciding which repositories are yours to commit to, and when to stop and ask. - `references/ecosystems.md` — how to detect each ecosystem, its discovery and apply commands, and the supply-chain cooldown that can hide a release from the resolver. - `references/commit-conventions.md` — the four commit tracks, subject grammar, body anatomy, and the empty-body rule. - `references/upstream-links.md` — which URLs each tool's bump cites, and how to verify them. - `references/follow-ups.md` — which bumps need a second commit, and how to declare a knowingly-red intermediate. - `references/holds.md` — deliberately staying behind on a package, and releasing the hold when its condition is met. ## Never run cargo-outdated It allocates around 18 GB resident and the OOM killer takes the whole host down with it on a memory-constrained machine. The cost is paid by starting the process, so there is no safe probe: do not run it to check whether the problem still reproduces, and do not offer it as an option. `cargo update --dry-run` reports the same thing safely. This holds until someone explicitly lifts the restriction — see the Rust section of t