upgrade-deps

upgrade-deps is a skill for Claude Code, Codex from edimuj/tokenlean. It costs 53 tokens per session (601 once invoked), scanned A, original, MIT.

A workflow for updating software dependencies, which are external packages a project relies on, while checking for breaking changes.

In plain words
What is it for?
Use it to audit package usage, research version changes, apply upgrades, run tests and remove outdated code.
Why use it?
It reduces the risk that a version upgrade silently breaks existing code or leaves obsolete compatibility code behind.

Skill for Claude CodeCodex

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/edimuj/tokenlean/upgrade-deps
Any agent
npx skills add edimuj/tokenlean --skill upgrade-deps
Clone the repo
git clone --depth 1 https://github.com/edimuj/tokenlean

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for upgrade-deps

README.md
[![agentmods](https://agentmods.dev/badge/skills/edimuj/tokenlean/upgrade-deps.svg)](https://agentmods.dev/skills/edimuj/tokenlean/upgrade-deps)
Your own site
<a href="https://agentmods.dev/skills/edimuj/tokenlean/upgrade-deps"><img src="https://agentmods.dev/badge/skills/edimuj/tokenlean/upgrade-deps.svg" alt="Measured on agentmods" height="20"></a>
Per session 53 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 601 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00053 $0.00601
Opus 5 $0.00026 $0.00300
Sonnet 5 $0.00011 $0.00120
Haiku 4.5 $0.00005 $0.00060

Measured 4d ago against content hash c51fa7c94478, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

upgrade-deps scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

skills/claude/upgrade-deps/SKILL.md · 89 lines

What it actually says

Upgrade Deps

Upgrade dependencies safely by understanding usage before changing versions.

Workflow

Audit → Research → Upgrade → Verify → Clean up

1. Audit

Understand current usage before changing anything:

tl parallel \
  "npm=tl npm <package>" \
  "search=tl search '<package-name>'" \
  "deps=tl deps <file>"

2. Research

Check what changed between versions:

tl parallel "browse=tl browse <changelog-url>" "docs=tl context7 <package> 'migration guide'"

Look for: removed APIs, renamed functions, changed defaults, new peer deps.

3. Upgrade

Apply the version bump:

# Update package.json and install
tl diff --breaking         # Detect signature mismatches in wrapper files
tl snippet <symbol> <file> # Check each usage site against new API

4. Verify

tl parallel \
  "test=tl run '<test command>'" \
  "testmap=tl test-map <file>" \
  "guard=tl guard"

5. Clean up

Remove old compatibility code:

tl parallel "unused=tl unused" "search=tl search '<old-version>'"

Decision tree

Upgrade request → How big is the version jump?
  ├─ Patch (1.2.3 → 1.2.4) → Light check
  │   → tl npm to confirm, upgrade, tl run tests
  ├─ Minor (1.2 → 1.3) → Standard check
  │   → tl search for usage, tl browse changelog
  │   → Upgrade, tl run tests
  └─ Major (1.x → 2.x) → Full audit
      → tl search for all usage sites
      → tl browse changelog + migration guide
      → tl snippet on every consumer
      → Upgrade, tl diff --breaking, tl run tests
      → tl unused to clean up compat code

Tips

  • tl npm output includes the changelog URL — use it with tl browse
  • Use tl context7 for popular frameworks (React, Next.js, etc.) — it has migration guides
  • Always check for changed peer dependencies after major upgrades
  • Run tl unused after removing compatibility code — catch leftover dead exports
  • Never upgrade a major version without reading the migration guide first
Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 4d ago First seen · 89 lines · 53 tokens per session scan A c51fa7c94478

Subscribe to this mod's changes

upgrade-deps is a skill published in the GitHub repository edimuj/tokenlean (11 stars, last pushed 1mo ago), licensed MIT. It adds 53 tokens to every session and 601 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other skills, from other repositories

zerodust

Sweep 100% of native gas tokens (ETH, BNB, MATIC, etc.) from EVM chains via ZeroDust, leaving exactly zero balance. Use when: user wants to exit a chain completely, consolidate dust balances, clean up wallets, or bridge remaining native tokens cross-chain. Supports 25 mainnet chains including Ethereum, Base, Arbitrum…

andresdefi/zerodust · 93 tokens

ctx2img

Cut context tokens by rendering it as images. ctx2img paint turns any text-shaped input (a repo, a directory, a file, markdown, stdin) into dense images that carry the full text at 60-75% fewer tokens, with stable handles and a verbatim factsheet; ctx2img read recovers guaranteed-exact text. Use before ingesting any…

Koukyosyumei/h5i-ctx2img · 103 tokens

r3f-animation

React Three Fiber animation - useFrame, useAnimations, spring physics, keyframes. Use when animating objects, playing GLTF animations, creating procedural motion, or implementing physics-based movement.

zebbern/claude-code-guide · 43 tokens

r3f-best-practices

React Three Fiber (R3F) and Poimandres ecosystem best practices. Use when writing, reviewing, or optimizing R3F code. Triggers on tasks involving @react-three/fiber, @react-three/drei, zustand, @react-three/postprocessing, @react-three/rapier, or leva.

zebbern/claude-code-guide · 74 tokens

log-error-digest

Analyze log files to troubleshoot errors, identify peak error periods, and produce error clustering, frequency statistics, and time distribution reports. Supports JSON, syslog, and Nginx formats with automatic detection. Use when a user uploads a .log file and asks to analyze errors, find patterns, debug issues, or…

zebbern/claude-code-guide · 71 tokens

muapi-ui-design

Generate high-fidelity UI/UX mockups for mobile and web apps using Atomic Design principles — creates wireframes and design systems via muapi.ai.

SamurAIGPT/Generative-Media-Skills · 34 tokens