What problem does it solve? Blind npm update runs mix safe patches with risky major bumps into one undiagnosable commit, so when something breaks you cannot tell which dependency caused it. This Skill turns a pile of outdated packages into an ordered, risk-tiered upgrade plan executed in small verified batches with clean, auditable commits. ## Core Features & Use Cases - Risk-tiered batching: Classifies outdated packages by type (direct/dev/transitive), bump kind (patch/minor/major), and blast radius, then orders them dev patches first, runtime majors last, one major per commit. - Verification between batches: Runs build, full test suite, lint, and smoke tests after every batch, with recovery guidance for trivial vs. non-trivial breakage. - Stuck-major handling: Reads migration guides, scopes breaking changes with ripgrep, and either upgrades in a dedicated slice or pins with a documented reason. - Use Case: Responding to a security advisory on a direct dependency while also doing a monthly hygiene pass — inventory with npm outdated and npm audit, present the batch plan, execute each batch with its own commit, and produce a summary of completed, deferred, and intentionally pinned upgrades. ## Quick Start Ask the assistant to upgrade the project's outdated dependencies safely in verified batches with one commit per major version.
