update-deps
Audit and update npm/Bun dependencies with supply chain integrity checks — verifies maintainers, publish age, tarball diffs, and provenance before bumping. Defers risky packages to ~/.supply-chain/notes/.
Profile →npx skills add backnotprop/plannotator --skill update-deps --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# Update Dependencies Audit outdated packages, verify supply chain integrity, bump what's safe, defer what needs review, and log everything. This process has three phases: discovery, integrity audit, and execution. The integrity audit is the most important — every package gets checked before it touches the lockfile. ## Phase 1: Discovery Run `bun outdated` to get the full list of packages with available updates. ```bash bun outdated ``` Parse the output into a structured list. For each package, note: - Package name - Current version - Available update version - Whether it's age-gated (indicated by `*` in the output — the footnote "The * indicates that version isn't true latest due to minimum release age" confirms this) - Whether it's a runtime dep, dev dep, or peer dep Also check whether any packages are blocked entirely by the age gate (like `@pierre/diffs` was when its minimum semver range couldn't resolve). Flag these separately — they may need `minimumReleaseAgeExcludes` in `bunfig.toml`. ## Phase 2: Integrity Audit This is the core of the process. Spawn one **Sonnet sub-agent per package** to run the integrity check in parallel. Sonnet is used here because these are independen
- Phase 1: Discovery
- Phase 2: Integrity Audit
- Sub-agent prompt template
- Collecting results
- Tier classification
- Phase 3: Execution
- Bump safe packages
- Log to supply chain notes
- Check previously deferred packages
- Phase 4: Recap
- Updated
- Deferred
- Still Deferred (from previous audits)
- Age Gate Exclusions
bun outdated bun update pkg1@version1 pkg2@version2 ...
What does the update-deps skill do?
Audit and update npm/Bun dependencies with supply chain integrity checks — verifies maintainers, publish age, tarball diffs, and provenance before bumping. Defers risky packages to ~/.supply-chain/notes/.
How do I install it?
Run `npx skills add backnotprop/plannotator --skill update-deps --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From backnotprop/plannotator, a repository with 7,510 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.