phx-deps-update
Bump outdated Hex deps — inventory, snapshot changelogs, update, fix breaks, split reviewable PRs (patches bundled, majors solo). Use to upgrade/bump Elixir dependencies or when versions fall behind. NOT for deps.get failures (/skill:phx-investigate).
npx skills add oliver-kriska/claude-elixir-phoenix --skill phx-deps-update --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# Dependency Update (Freshness) Inventory → update → fix breaks → grouped PRs. This is the only MUTATING deps skill: it edits `mix.exs`, `mix.lock`, and source. Security scanning stays in `/skill:phx-deps-audit`; the vet ledger stays in `/skill:phx-deps-vet`. ## Usage ``` /skill:phx-deps-update # inventory + interactive scope pick /skill:phx-deps-update --scope patch # bundle all patch bumps, one PR /skill:phx-deps-update --pkg phoenix_live_view # one package (+ coupled group) /skill:phx-deps-update --dry-run # inventory only, no changes ``` ## Iron Laws 1. **NEVER cross a major version without an explicit `mix.exs` edit** — `mix deps.update` stays within requirements. Edit the constraint first; add `override: true` only when `mix hex.outdated <pkg>` shows a transitive consumer blocking. One major per PR 2. **ALWAYS snapshot the changelog delta BEFORE updating** — capture `deps/<pkg>/CHANGELOG.md`, then delta via `mix hex.package diff`. Never update blind 3. **NEVER claim an update is safe without verification** — run `/skill:phx-verify` (compile --warnings-as-errors + test). "Compiles" ≠ "works" 4. **ALWAYS move coupled packages together** — Phoenix core, Ecto, Ash, Oban, telemetr
- Usage
- Iron Laws
- Workflow
- Phase 0: Discover
- Phase 1: Inventory
- Phase 2: Scope (AskUserQuestion)
- Phase 3: Per-Package Update Loop
- Phase 4: Verify
- Phase 5: Breaking-Change Fixes
- Phase 6: Security Handoff
- Phase 7: Group, Commit, PR
- Integration
- References
What does the phx-deps-update skill do?
Bump outdated Hex deps — inventory, snapshot changelogs, update, fix breaks, split reviewable PRs (patches bundled, majors solo). Use to upgrade/bump Elixir dependencies or when versions fall behind. NOT for deps.get failures (/skill:phx-investigate).
How do I install it?
Run `npx skills add oliver-kriska/claude-elixir-phoenix --skill phx-deps-update --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From oliver-kriska/claude-elixir-phoenix, a repository with 515 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.