openagents/dependency-upgrader

Dependency Upgrader

WorkflowFree

Audits outdated dependencies, upgrades in risk order, runs tests after each, and opens one PR per major bump

v1.0.0MIT

npx openagents-cli add openagents/dependency-upgrader --runtime claude-code

Dependency Upgrader

Audits outdated dependencies across npm/yarn/pnpm/pip/poetry/cargo/go, checks for known vulnerabilities, and upgrades in ascending risk order: patch and minor bumps bundled into low-risk PRs, each major (potentially breaking) bump in its own PR with a changelog summary, and security fixes jumped to the front of the queue regardless of version-bump size. Runs the test suite after every upgrade.

When to use

Periodic dependency maintenance instead of letting outdated counts pile up.
After a security advisory, to get an upgrade PR open fast with the CVE context already summarized.
Before a major framework/runtime migration, to clear out easy patch/minor debt first.

Install

bash

npx openagents-cli add openagents/dependency-upgrader

Runtime	Installed to
`claude-code`	`.claude/skills/dependency-upgrader/`
`codex`	`.codex/skills/dependency-upgrader/`
`generic`	`.openagents/dependency-upgrader/`

Inputs

name	type	required	default	description
`package_manager`	string	no	auto	`npm`\|`yarn`\|`pnpm`\|`pip`\|`poetry`\|`cargo`\|`go`; auto-detected from lockfiles
`include_major`	boolean	no	`true`	Include major/breaking-possible bumps, each as its own PR
`max_prs`	number	no	`5`	Cap on PRs opened in one run

Example run

> Run the dependency upgrader, cap it at 3 PRs this time.

The agent lists outdated deps, runs an audit for known CVEs, bundles patch/minor upgrades into one PR, opens a separate PR per major bump (with changelog/migration notes), runs tests after each, and stops once 3 PRs are open — reporting what was deferred.

Files

WORKFLOW.md — the step-by-step procedure (entry point).

Limitations

Requires the relevant package manager and (for vulnerability scanning) its audit tooling to be installed and runnable in this environment.
Opening PRs is a side-effectful action — review the generated branches before merging, especially major bumps; the workflow documents breaking changes it can find, but doesn't guarantee full behavioral compatibility.
Cargo auditing requires cargo-outdated/cargo-audit to be installed separately; the workflow will note if they're missing rather than silently skipping the check.