upgrade-deps

A workflow for updating the pyatlan Python SDK’s direct package dependencies and GitHub Actions, which automate tasks such as testing and releases.

In plain words
What is it for?
Use it to check direct dependencies, choose compatible versions, update the project lock file and workflow files, and use uv for Python package operations.
Why use it?
It finds outdated packages while respecting the project’s Python 3.9 support, avoiding upgrades that require a newer Python version.

Skill for Claude CodeCodex

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/atlanhq/atlan-python/upgrade-deps
Any agent
npx skills add atlanhq/atlan-python --skill upgrade-deps
Clone the repo
git clone --depth 1 https://github.com/atlanhq/atlan-python

Made for: Claude Code, Codex.

Per session 19 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 1,050 The whole file, excluding the scripts and references it only reads on demand.
Security scan C 2 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00019 $0.01050
Opus 5 $0.00010 $0.00525
Sonnet 5 $0.00004 $0.00210
Haiku 4.5 $0.00002 $0.00105

Measured 2d ago against content hash 73d050b99a08, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade C, and why

upgrade-deps scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Downloads and executes remote codehighSupply chain

curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.

curl -s https://pypi.org/pypi/<package>/<new-version>/json | python3 -c "import json,sys; d=json.load(sys.stdin); print(d['info']['requires_python'])"

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

curl -s https://pypi.org/pypi/<package>/<new-version>/json | python3 -c "import json,sys; d=json.load(sys.stdin); print(d['info']['requires_python'])"
.claude/skills/upgrade-deps/SKILL.md · 141 lines

How it starts

The opening of the file, as written. The whole thing — 141 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Upgrade all dependencies for the pyatlan Python SDK. Follow these steps carefully.

Context

  • The project supports Python >=3.9, so skip any package version that requires Python >=3.10 or higher
  • Use uv for all Python package operations
  • Workflow files are in .github/workflows/
  • Dependencies are managed in pyproject.toml and locked in uv.lock

Step 1 — Find outdated Python packages

Run:

uv pip list --outdated

Cross-reference the output with the direct dependencies pinned in pyproject.toml (sections: dependencies, dev, docs). Ignore transitive dependencies — only update packages that are explicitly listed in pyproject.toml.


Step 2 — Check Python version compatibility for each outdated package

For every package identified in Step 1, check its requires_python field:

curl -s https://pypi.org/pypi/<package>/<new-version>/json | python3 -c "import json,sys; d=json.load(sys.stdin); print(d['info']['requires_python'])"

Rules:

  • If requires_python is >=3.9 or lower (or None) → safe to upgrade
  • If requires_python is >=3.10 or higher → check if an older compatible version exists:
    curl -s https://pypi.org/pypi/<package>/json | python3 -c "
    import json, sys
    d = json.load(sys.stdin)
    for v in sorted(d['releases'].keys(), reverse=True)[:10]:
        rels = d['releases'][v]
        if rels:
            rp = rels[0].get('requires_python','')
            print(f'{v}: {rp}')
    "
    
    Pick the highest version that supports Python 3.9. If already at that version, skip it.
  • Packages already conditioned in pyproject.toml with ; python_version >= '3.10' (like filelock) can be upgraded freely since they only install on 3.10+

Step 3 — Update pyproject.toml

For each package that can be safely upgraded, update its version pin in pyproject.toml.

Keep the same ~=X.Y.Z pinning style as used by other packages in the file.


Step 4 — Upgrade GitHub Actions

Scan all workflow files in .github/workflows/ for uses: lines:

grep -rh "uses:" .github/workflows/ | sort -u

Read the full file on GitHub · 141 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 141 lines · 19 tokens per session scan C 73d050b99a08

Subscribe to this mod's changes

upgrade-deps is a skill published in the GitHub repository atlanhq/atlan-python (22 stars, last pushed 5d ago), licensed Apache-2.0. It adds 19 tokens to every session and 1,050 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it C with 2 findings (downloads and executes remote code, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other skills, from other repositories

pixiv-cli-ci

Diagnose, verify, monitor, and safely operate pixiv-cli GitHub Actions runs and local CI gates, including PR Quality gate, workflow policy, platform smoke, native/browser evidence, release handoffs, and approved reruns. Use when checks fail or hang, a PR needs readiness verification, a workflow run needs root-cause…

FlanChanXwO/pixiv-cli · 82 tokens

zapier-sdk

Zapier SDK for TypeScript. Programmatic access to 9,000+ apps on a user's behalf via Zapier's OAuth and audit layer. Use when writing code that needs to run actions in third-party apps (send an email, upsert a CRM record, look up a spreadsheet row, post to a chat) without managing per-app OAuth or vendor SDKs.…

zapier/sdk · 151 tokens

release

Checklist for releasing packages from this monorepo (code PR -> Version Packages PR -> npm publish).

transloadit/node-sdk · 22 tokens

huawei-deployment

Use when creating, managing, or running deployment tasks and pipelines on Huawei Cloud CloudDeploy. Triggers: CloudDeploy, deployment, CI/CD, pipeline, release, artifact deployment, deploy task. NOT for: CodeArts Build (build pipeline), SWR container registry.

huaweicloud/huaweicloud-devkit · 59 tokens

developer-tools

CLI tools, SDKs, and developer experience patterns.

miles990/claude-software-skills · 13 tokens

deploy

THE one runbook for shipping PipRail — the complete, crystal-clear checklist of everything that must be updated and done for a successful deployment of @piprail/sdk and/or @piprail/mcp: the version files, every doc/README/llms.txt surface, the verification gate, the tag-driven npm publish, the GitHub Releases, the MCP…

piprail/piprail · 187 tokens