# Update Deps

Audit and update npm/Bun dependencies with supply chain integrity checks, verifies...

- Repository: https://github.com/backnotprop/plannotator (9810 stars)
- Category: Writing
- License: Apache-2.0
- Last updated: 2026-11-01
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add backnotprop/plannotator --skill update-deps -g -a claude-code -y`
Codex: `npx skills add backnotprop/plannotator --skill update-deps -g -a codex -y`
Cursor: `npx skills add backnotprop/plannotator --skill update-deps -g -a cursor -y`
Gemini CLI: `npx skills add backnotprop/plannotator --skill update-deps -g -a gemini-cli -y`
Claude Code plugin marketplace: `/plugin marketplace add backnotprop/plannotator`

## Description

Audit and update npm/Bun dependencies with supply chain integrity checks, verifies maintainers, publish age, tarball diffs, and provenance before bumping. Defers risky packages to ~/.supply-chain/notes/.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Update Dependencies

Audit outdated packages, verify supply chain integrity, bump what's safe, defer what needs review, and log everything.

This process has three phases: discovery, integrity audit, and execution. The integrity audit is the most important, every package gets checked before it touches the lockfile.

## Phase 1: Discovery

Run `bun outdated` to get the full list of packages with available updates.

```bash
bun outdated
```

Parse the output into a structured list. For each package, note:
- Package name
- Current version
- Available update version
- Whether it's age-gated (indicated by `*` in the output, the footnote "The * indicates that version isn't true latest due to minimum release age" confirms this)
- Whether it's a runtime dep, dev dep, or peer dep

Also check whether any packages are blocked entirely by the age gate (like `@pierre/diffs` was when its minimum semver range couldn't resolve). Flag these separately, they may need `minimumReleaseAgeExcludes` in `bunfig.toml`.

## Phase 2: Integrity Audit

This is the core of the process. Spawn one **Sonnet sub-agent per package** to run the integrity check in parallel. Sonnet is used here because these are independent, structured verification tasks that don't need heavier reasoning.

Each sub-agent receives the package name, current version, and target version, and performs the following checks:

### Sub-agent prompt template

For each outdated package, spawn a Sonnet agent with this task:

```
You are auditing the npm package "{package}" for a version bump from {current} to {target}.

Run these checks and report back with a JSON object:

1. **Maintainer verification**: Check if maintainers changed between versions.
   npm view {package}@{current} maintainers --json
   npm view {package}@{target} maintainers --json
   Compare the two lists. Flag any additions or removals.

The rest: https://github.com/backnotprop/plannotator/blob/HEAD/.agents/skills/update-deps/SKILL.md