Dependency Upgrade

This handles the full lifecycle of upgrading dependencies with supply chain security baked in: cooldown periods to let new packages age before you install them, post-install script blocking to prevent arbitrary code execution, and lockfile validation to catch injection attacks. It supports npm, Bun, pnpm, Yarn, and Deno with specific hardening configs for each. You can run it in default mode for instant opinionated setup (7-day cooldown, scripts blocked, Dependabot configured) or go interactive to customize everything from automerge policies to Socket CLI integration. It's built around the reality that supply chain attacks happen fast and most teams don't have good defenses in place until after an incident.

skills.sh installs: 415
GitHub stars: 248
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add secondsky/claude-skills --skill dependency-upgrade --agent claude-code

Installs into .claude/skills of the current project.

Files

Dependency Upgrade

Manage dependency upgrades with supply chain security, compatibility analysis, staged rollout, and comprehensive testing across all major package managers.

When to Use This Skill

Upgrading major framework or library versions
Configuring supply chain attack prevention (cooldown, script blocking, lockfile hardening)
Setting up secure package manager configuration
Resolving dependency conflicts or peer dependency issues
Planning incremental upgrade paths with testing
Automating dependency updates with Renovate, Dependabot, or Snyk
Auditing dependencies for vulnerabilities
Setting up CI/CD dependency security workflows

Two Modes of Operation

Interactive — Walk through setup questions to generate tailored config. Use for fresh setup.

Default — Apply recommended defaults immediately: 7-day cooldown, block all scripts, frozen-lockfile, lockfile-lint, Dependabot with cooldown. Customization optional.