{
  "name": "dependency-upgrade-review",
  "version": "0.2.1",
  "description": "Give a merge verdict on a dependency-upgrade pull request (Dependabot, Renovate or a hand-made bump) across npm, pip, Go, Cargo and Maven lockfiles and GitHub Actions pins. Reads the release notes for every skipped version, lists what the lockfile changes beyond the PR title (transitive bumps, new and removed packages, install scripts, registry changes), checks each SHA pin against its release tag and against the PR's other pins, checks raised runtime floors against the images and runners that install it, says whether CI ran the changed code, traces what each caller of a changed API now does and writes the rollback. The reply leads with MERGE, MERGE AFTER CHECKS or DO NOT MERGE and the reasons that decide it. Use when the user says \"review this Dependabot PR\", \"is this Renovate bump safe to merge\", \"can I merge this dependency upgrade\", \"check this lockfile diff\", or \"is this action SHA pin right\".",
  "entrypoint": "SKILL.md",
  "deps": {
    "npm": [],
    "pip": []
  },
  "env": {
    "required": [],
    "optional": []
  },
  "related": [
    "migration-plan",
    "pre-merge-review",
    "release-notes"
  ],
  "handoff": [
    {
      "to": "migration-plan",
      "when": "the upgrade is a major framework or runtime jump that cannot land as one PR",
      "purpose": "Plan the staged migration, the compatibility shims and the cutover instead of forcing the bump through.",
      "fallback": "If migration-plan is absent, list the breaking changes the repo hits, the order to fix them in, and the rollback point for each step inline, and keep the verdict at DO NOT MERGE."
    },
    {
      "to": "pre-merge-review",
      "when": "the PR also carries hand-written code changes beyond manifests, lockfiles and pins",
      "purpose": "Review the code change itself with the full correctness, security and quality pass.",
      "fallback": "If pre-merge-review is absent, review the non-dependency files inline for correctness and tests, and say that part of the review was done without the full panel."
    }
  ],
  "tags": [
    "dependencies",
    "supply-chain",
    "code-review",
    "dependabot",
    "github-actions"
  ],
  "permissions": {
    "network": [
      "github.com",
      "api.github.com",
      "registry.npmjs.org",
      "pypi.org",
      "proxy.golang.org"
    ],
    "commands": [
      "git",
      "gh",
      "npm",
      "pip",
      "go"
    ],
    "files": "named-paths",
    "notes": "The script reads only the diff path it is given, or stdin, writes only the -o path when given, and makes no network calls. The instructions read the PR with gh or git, list a package's releases with npm, pip, go or gh, and verify a SHA pin with git ls-remote against github.com; gh reaches api.github.com and the package managers their registries; with no network those become commands in the reply for the reviewer to run."
  },
  "model": {
    "tier": "standard",
    "rationale": "Reads a version diff, changelogs and CI evidence against a fixed checklist; the merge verdict follows from what is verified, not open-ended judgment."
  }
}