yet-another-agent-harness: Skill for Claude Code

Safe Dependency Upgrade

Systematically upgrade dependencies with zero breakage. Detects the project ecosystem, audits for outdated and vulnerable packages, presents a prioritized plan for approval, then executes upgrades one at a time with test verification after each.

Core principle: One upgrade at a time. Test after each. Roll back on failure. Never auto-commit.

Prerequisite check

Detect the project ecosystem by scanning for package manager files:

ls go.mod package.json pyproject.toml Cargo.toml *.csproj 2>/dev/null

If no package manager file is found, report to the user and stop. Mixed projects (e.g., Go backend + Node frontend) are supported — audit and upgrade each ecosystem separately.

Step 1: Audit dependencies

List outdated packages and run vulnerability scanners for each detected ecosystem.

Go:

go list -u -m all 2>/dev/null | grep '\['
govulncheck ./... 2>/dev/null

Node.js:

npm outdated 2>/dev/null
npm audit 2>/dev/null

Python:

pip list --outdated 2>/dev/null
pip-audit 2>/dev/null

Rust:

cargo outdated 2>/dev/null
cargo audit 2>/dev/null

.NET:

dotnet list package --outdated 2>/dev/null
dotnet list package --vulnerable 2>/dev/null

For detailed commands per ecosystem, see references/upgrade-commands.md.

If a vulnerability scanner is not installed, note it in the report but continue with the outdated package list.

Step 2: Categorize and prioritize

For each outdated package, assign a priority:

• CRITICAL — known CVE or security advisory
• HIGH — major version behind or dependency EOL
• MEDIUM — minor version behind
• LOW — patch version behind only

For detailed priority signals and breaking change assessment, see references/priority-matrix.md.

Step 3: Present upgrade plan

Present the prioritized list to the user before any upgrades. Use the plan format in references/report-template.md.