update-deps
update-deps
Move a repo's dependencies to their newest allowed versions — minor by default, patch or major only when explicitly asked. Manual invocation only. The skill plans first and writes only after confirmation or explicit existing session authorization, and never commits, pushes, opens a PR or merges: the verified working tree is the deliverable, and atomic-commit and pull-request own what comes after it.
Its one principle:
The repo's own tooling and config decide what "allowed" means. A release-age gate, an exact pin, a declared constraint, a private registry — each is a deliberate choice to honour, never an obstacle to route around. What the skill does not move, it reports with the reason. Silence is the one failure mode this skill exists to prevent.
The sibling skill merge-deps triages the Dependabot queue — updates a bot already opened as PRs; this one performs them locally. They cannot collide: merge-deps refuses any request its configured bot did not author, and this skill authors none.