dependency-upgrades

Four skills run in order, each consuming the previous one's table. An inventory pass records every manifest, every declared constraint and every resolved version — declared and resolved separately, because they differ and the difference decides whether a file needs editing. A research pass produces four different numbers per dependency: current, latest stable, latest within the deployment ceiling, and latest reachable without a breaking change, plus support status, end-of-life date and advisories. Then planning and execution, one change per commit.

The ordering is the substance. Find the deployment ceiling before researching the latest version, because a function runtime or a managed cluster decides how far you can actually go. Check the test suite could detect a regression before upgrading anything. Rank by support status rather than by how far behind you are.

It covers Node, Python, Go, Rust, Ruby, the JVM, Terraform, container base images, CI runner and action versions and pre-commit hook revisions, in whatever combination a repository actually contains.

It is not a CVE scanner and is not a substitute for one. It reads advisories that registries and lockfile auditors already publish; it has no advisory database of its own. Run a real scanner in CI and use this to act on what it reports.