skills.rest
nodesource
nodesourceOFFICIAL
Explore all skills by this author →
Website𝕏@NodeSourceGitHub

ns-upgrade-package

Plans npm package upgrades with semver risk assessment and NCM security data.

6|7|Updated Jun 4, 2026
Search Tags:#vulnerability#npm#package manager#semver#nodejs#dependency upgrade#lockfile
One-click install
npx skills add https://github.com/nodesource/nsolid-plugin --skill ns-upgrade-package-nodesource
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: ns-upgrade-package
Source: https://github.com/nodesource/nsolid-plugin/tree/main/skills/ns-upgrade-package
Command: npx skills add https://github.com/nodesource/nsolid-plugin --skill ns-upgrade-package-nodesource

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Upgrading a single npm dependency carries hidden risks: breaking changes, peer dependency conflicts, and known vulnerabilities in the target version. This Skill produces a structured upgrade plan so you know the current state, the risk level, and the exact commands before touching your lockfile. ## Core Features & Use Cases - Version Detection: Reads package.json and lockfiles (npm, pnpm, yarn) to find the installed version and dependency type. - NCM Security & Quality Check: Queries NCM via getPackageQuality for vulnerabilities, license, and quality scores on current and target versions. - SemVer Risk Classification: Classifies the change as major, minor, or patch and scales risk by workspace usage count and transitive dependents. - Use Case: You want to bump lodash to the latest version. The Skill reports your installed version, flags any CVEs in the target release, counts how many files import lodash, and gives exact pnpm/npm/yarn commands plus a rollback path via .nsolid/backup/. ## Quick Start Ask the assistant to plan an upgrade of a specific package in this project, for example to upgrade express to the latest version and assess the risk.

Frequently Asked Questions about ns-upgrade-package

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I safely upgrade an npm package to the latest version?▼

First detect the installed version from package.json and the lockfile, then check NCM for vulnerabilities in the target version. Classify the semver change type, review workspace usage, run the package-manager-specific upgrade command, and verify with tests and peer dependency checks.

How do I assess breaking changes before updating a dependency?▼

Use semver heuristics: major version bumps carry high breaking-change risk, minor bumps are backward-compatible, and patches are low risk. Scale the risk by counting workspace files importing the package and its transitive dependents, then consult the official CHANGELOG for specifics.

Does this work with pnpm and yarn lockfiles?▼

Yes. The Skill reads package-lock.json packages entries, pnpm-lock package snapshots, and yarn.lock entries to determine installed versions. It generates upgrade commands matching whichever package manager the project uses.

What happens if a peer dependency conflict appears during upgrade?▼

The upgrade stops rather than forcing the install. The Skill proposes compatible version ranges instead, and you can verify peer requirements afterward with npm ls, yarn explain peer-requirements, or pnpm why.

How do I roll back a failed package upgrade?▼

N|Solid automatically backs up package.json and the lockfile to .nsolid/backup/ before each upgrade. Click Rollback in the post-upgrade notification or manually restore the files from that directory.

When should I replace a package instead of upgrading it?▼

Switch to a replacement workflow when moving to a different library rather than bumping versions. The Skill can compare NCM quality and vulnerability data for the alternative package against the current one before recommending a switch.

Related Skills

Explore More Software Engineering Skills→
emanuelrechsteineremanuelrechsteiner

dependency-audit

Audit npm dependencies for vulnerabilities, outdated packages, and unused packages.

Community
Advanced
multiversxmultiversx
12

fix_verification

Verify smart contract bug fixes by running Mandos scenarios and regression tests.

Official
Intermediate
Sir-chawakornSir-chawakorn
9

performance-profiling

Diagnose runtime performance issues by profiling hotspots and analyzing before-and-after measurements.

Community
Advanced
sayedihashimisayedihashimi
2

migrate-mstest-v1v2-to-v3

Migrate MSTest v1 or v2 projects to MSTest v3 packages and configurations.

Community
Advanced