What does ln-710 do with detected package managers?

It detects npm/yarn/pnpm, NuGet, and Python tools, then delegates upgrades to the appropriate workers (ln-711, ln-712, ln-713) using a standardized delegation context.

What is the delegation context and why is it important?

The delegation context includes projectPath, packageManager, and options (upgradeType, allowBreaking, testAfterUpgrade). It ensures consistent behavior and isolation across workers during upgrades.

How are security and release-age considerations handled?

Phase 2 performs vulnerability checks (e.g., npm audit, pip-audit, nuget list) and applies release-age rules (minimumReleaseAge) to skip very new packages, aligning with Renovate best practices.

ln-710-dependency-upgrader

npx machina-cli add skill levnikolaevich/claude-code-skills/ln-710-dependency-upgrader --openclaw

Files (1)

SKILL.md

6.6 KB

Paths: File paths (shared/, references/, ../ln-*) are relative to skills repo root. If not found at CWD, locate this SKILL.md directory and go up one level for repo root.

ln-710-dependency-upgrader

Type: L2 Domain Coordinator Category: 7XX Project Bootstrap Parent: ln-700-project-bootstrap

Coordinates dependency upgrades by detecting package managers and delegating to appropriate L3 workers.

Overview

Aspect	Details
Input	Detected stack from ln-700
Output	All dependencies upgraded to latest compatible versions
Workers	ln-711 (npm), ln-712 (nuget), ln-713 (pip)

Workflow

See diagram.html for visual workflow.

Phases: Pre-flight → Detect → Security Audit → Delegate → Collect → Verify → Report

Phase 0: Pre-flight Checks

Verify project state before starting upgrade.

Check	Method	Block if
Uncommitted changes	`git status --porcelain`	Non-empty output
Create backup branch	`git checkout -b upgrade-backup-{timestamp}`	Failure
Lock file exists	Check for lock file	Missing (warn only)

Skip upgrade if uncommitted changes exist. User must commit or stash first.

Phase 1: Detect Package Managers

Detection Rules

Package Manager	Indicator Files	Worker
npm	package.json + package-lock.json	ln-711
yarn	package.json + yarn.lock	ln-711
pnpm	package.json + pnpm-lock.yaml	ln-711
nuget	*.csproj files	ln-712
pip	requirements.txt	ln-713
poetry	pyproject.toml + poetry.lock	ln-713
pipenv	Pipfile + Pipfile.lock	ln-713

Phase 2: Security Audit (Pre-flight)

Security Checks

Package Manager	Command	Block Upgrade
npm	`npm audit --audit-level=high`	Critical only
pip	`pip-audit --json`	Critical only
nuget	`dotnet list package --vulnerable`	Critical only

Release Age Check

Option	Default	Description
minimumReleaseAge	14 days	Skip packages released < 14 days ago
ignoreReleaseAge	false	Override for urgent security patches

Per Renovate best practices: waiting 14 days gives registries time to pull malicious packages.

Phase 3: Delegate to Workers

CRITICAL: All delegations use Task tool with subagent_type: "general-purpose" for context isolation.

Prompt template:

Task(description: "Upgrade deps via ln-71X",
     prompt: "Execute ln-71X-{worker}. Read skill from ln-71X-{worker}/SKILL.md. Context: {delegationContext}",
     subagent_type: "general-purpose")

Anti-Patterns:

❌ Direct Skill tool invocation without Task wrapper
❌ Any execution bypassing subagent context isolation

Delegation Context

Each worker receives standardized context:

Field	Type	Description
projectPath	string	Absolute path to project
packageManager	enum	npm, yarn, pnpm, nuget, pip, poetry, pipenv
options.upgradeType	enum	major, minor, patch
options.allowBreaking	bool	Allow breaking changes
options.testAfterUpgrade	bool	Run tests after upgrade

Worker Selection

Package Manager	Worker	Notes
npm, yarn, pnpm	ln-711-npm-upgrader	Handles all Node.js
nuget	ln-712-nuget-upgrader	Handles .NET projects
pip, poetry, pipenv	ln-713-pip-upgrader	Handles all Python

Phase 4: Collect Results

Result Schema

Field	Type	Description
status	enum	success, partial, failed
upgrades[]	array	List of upgraded packages
upgrades[].package	string	Package name
upgrades[].from	string	Previous version
upgrades[].to	string	New version
upgrades[].breaking	bool	Is breaking change
warnings[]	array	Non-blocking warnings
errors[]	array	Blocking errors

Phase 5: Verify Build

Build Commands by Stack

Stack	Command
Node.js	`npm run build` or `yarn build`
.NET	`dotnet build --configuration Release`
Python	`pytest` or `python -m pytest`

On Build Failure

Identify failing package from error
Search Context7/Ref for migration guide
Apply known fixes
If still fails: rollback package, log warning

Phase 6: Report Summary

Report Schema

Field	Type	Description
totalPackages	int	Total packages analyzed
upgraded	int	Successfully upgraded
skipped	int	Already latest
failed	int	Rolled back
breakingChanges	int	Major version upgrades
buildVerified	bool	Build passed after upgrade
duration	string	Total time

Configuration

Options:
  # Upgrade scope
  upgradeType: major          # major | minor | patch

  # Breaking changes
  allowBreaking: true
  autoMigrate: true           # Apply known migrations

  # Security
  auditLevel: high            # none | low | moderate | high | critical
  minimumReleaseAge: 14       # days, 0 to disable
  blockOnVulnerability: true

  # Scope
  skipDev: false              # Include devDependencies
  skipOptional: true          # Skip optional deps

  # Verification
  testAfterUpgrade: true
  buildAfterUpgrade: true

  # Rollback
  rollbackOnFailure: true

Error Handling

Recoverable Errors

Error	Recovery
Peer dependency conflict	Try --legacy-peer-deps
Build failure	Rollback package, continue
Network timeout	Retry 3 times

Fatal Errors

Error	Action
No package managers found	Skip this step
All builds fail	Report to parent, suggest manual review

References

Definition of Done

Pre-flight checks passed (clean git state, backup branch created)
All package managers detected from indicator files
Security audit completed per manager (critical vulns block upgrade)
Workers delegated via Task tool with context isolation
Worker results collected with upgrade/skip/fail counts
Build verified after all upgrades applied
Summary report generated with totalPackages, upgraded, skipped, failed, buildVerified

Version: 1.1.0 Last Updated: 2026-01-10

Source

git clone https://github.com/levnikolaevich/claude-code-skills/blob/master/ln-710-dependency-upgrader/SKILL.mdView on GitHub

Overview

ln-710-dependency-upgrader orchestrates dependency upgrades by detecting all package managers in a project and delegating tasks to the appropriate workers (ln-711, ln-712, ln-713). This ensures upgrades are aligned across npm/yarn/pnpm, NuGet, and Python tools, delivering a unified upgrade outcome. It also enforces pre-flight checks, security audits, and standardized delegation contexts.

How This Skill Works

The skill performs pre-flight checks, detects the package managers present, and runs a security audit before delegating upgrades to specialized workers. Delegations use a Task tool with subagent_type: general-purpose and pass a standardized delegationContext to the appropriate worker (ln-711 for Node.js tools, ln-712 for NuGet, ln-713 for Python). Results are collected, verified, and reported in a consolidated upgrade result.

When to Use It

You have a mono-repo or multi-language project with npm/yarn/pnpm, NuGet, and Python dependencies needing coordinated upgrades.
You want to upgrade all dependencies to latest compatible versions in one pass to reduce drift between ecosystems.
You need pre-flight safety checks (uncommitted changes, backups) and a backup strategy before upgrading.
You require a standardized delegation context to ensure consistent upgrade behavior across different package managers.
You want to enforce security auditing and verification steps before applying upgrades.

Quick Start

Step 1: Run ln-710 to detect all package managers in the project and determine the workers to delegate to.
Step 2: Specify upgradeType (major/minor/patch) and set options like allowBreaking and testAfterUpgrade before starting.
Step 3: Review the consolidated results report, run tests if enabled, and merge changes after verification.

Best Practices

Run Phase 0 pre-flight checks and create a backup branch before starting upgrades.
Explicitly set upgradeType (major, minor, patch) and consider options.allowBreaking for risky changes.
Always use the Task wrapper for delegations to maintain isolation and traceability.
Optionally enable testAfterUpgrade to automatically validate upgrades with tests.
Perform security audits (npm audit, pip-audit, etc.) and respect release age guidelines before upgrading.

Example Use Cases

A multi-repo project with npm for frontend and NuGet for backend requires synchronized upgrades to avoid breaking cross-language integrations.
A Python project using poetry and pipenv coordinates Python dependencies in one upgrade pass to minimize version conflicts.
A legacy C# project upgrades NuGet packages while ensuring corresponding Python/JS dependencies are kept in sync.
Security-first upgrade: run npm audit and pip-audit prior to applying upgrades and wait for safe windows.
Upgrade reporting: after upgrading, collect a unified report detailing upgraded packages, versions, and verification status.

Frequently Asked Questions

Add this skill to your agents