Upgrade Dependencies PR

Use this skill to take a JavaScript, TypeScript, or Python repository from outdated dependencies to a reviewable dependency-upgrade PR in one pass.

Preconditions

• Confirm the repository uses Git and GitHub, and that gh is authenticated before attempting issue or PR creation.
• Stop if the working tree contains unrelated user changes that would be risky to mix into the dependency branch.
• Detect the ecosystem and package manager from tracked manifests, lockfiles, and workspace config before changing anything.
• Read references/package-manager-playbook.md after detection and use only the relevant section.

Workflow

1. Inventory the project

• Find the tracked dependency manifests that actually govern this repo. For JS/TS, inspect package.json files plus lockfiles and workspace config. For Python, inspect pyproject.toml, uv.lock, requirements*.in, requirements*.txt, constraints*.txt, setup.cfg, and setup.py.
• Identify whether the repo is JS/TS, Python, or mixed. Do not reject a repo just because there is no root package.json; use the manifests that are actually present.
• Record the current branch, package manager, lockfiles, workspace layout, and available validation commands such as typecheck, lint, test, test:unit, build, pytest, ruff, mypy, and project-specific CI entrypoints.
• Flag framework- or runtime-critical packages first: frameworks, bundlers, test runners, linters, TypeScript, Node tooling, auth, database clients, SDKs, deployment libraries, Python web frameworks, ORMs, packaging/build backends, and lint/type-check tooling.