1
# Dependency Upgrader
2
3
Audits outdated dependencies across npm/yarn/pnpm/pip/poetry/cargo/go, checks for known
4
vulnerabilities, and upgrades in ascending risk order: patch and minor bumps bundled
5
into low-risk PRs, each major (potentially breaking) bump in its own PR with a
6
changelog summary, and security fixes jumped to the front of the queue regardless of
7
version-bump size. Runs the test suite after every upgrade.
8
9
## When to use
10
11
- Periodic dependency maintenance instead of letting `outdated` counts pile up.
12
- After a security advisory, to get an upgrade PR open fast with the CVE context
13
  already summarized.
14
- Before a major framework/runtime migration, to clear out easy patch/minor debt first.
15
16
## Install
17
18
```bash
19
npx openagents-cli add openagents/dependency-upgrader
20
```
21
22
| Runtime | Installed to |
23
|---|---|
24
| `claude-code` | `.claude/skills/dependency-upgrader/` |
25
| `codex` | `.codex/skills/dependency-upgrader/` |
26
| `generic` | `.openagents/dependency-upgrader/` |
27
28
## Inputs
29
30
| name | type | required | default | description |
31
|---|---|---|---|---|
32
| `package_manager` | string | no | auto | `npm`\|`yarn`\|`pnpm`\|`pip`\|`poetry`\|`cargo`\|`go`; auto-detected from lockfiles |
33
| `include_major` | boolean | no | `true` | Include major/breaking-possible bumps, each as its own PR |
34
| `max_prs` | number | no | `5` | Cap on PRs opened in one run |
35
36
## Example run
37
38
```
39
> Run the dependency upgrader, cap it at 3 PRs this time.
40
```
41
42
The agent lists outdated deps, runs an audit for known CVEs, bundles patch/minor
43
upgrades into one PR, opens a separate PR per major bump (with changelog/migration
44
notes), runs tests after each, and stops once 3 PRs are open — reporting what was
45
deferred.
46
47
## Files
48
49
- `WORKFLOW.md` — the step-by-step procedure (entry point).
50
51
## Limitations
52
53
- Requires the relevant package manager and (for vulnerability scanning) its audit
54
  tooling to be installed and runnable in this environment.
55
- Opening PRs is a side-effectful action — review the generated branches before
56
  merging, especially major bumps; the workflow documents breaking changes it can
57
  find, but doesn't guarantee full behavioral compatibility.
58
- Cargo auditing requires `cargo-outdated`/`cargo-audit` to be installed separately;
59
  the workflow will note if they're missing rather than silently skipping the check.
60