music_library/.agents/skills/update-dependencies/SKILL.md

name, description

name	description
update-dependencies	Use when the user asks to update, upgrade, or refresh project dependencies, or when outdated dependencies need attention. Also use when the user mentions "outdated", "bump", "upgrade", or asks about dependency versions — even if they don't say "update dependencies" explicitly.

Update Dependencies

This project has five dependency categories checked by mise run dev:outdated: NPM packages, Tailwind, ESBuild, Sqlean (SQLite extensions), and Mix (Hex) packages. Dependabot handles GitHub Actions, Docker, Mix, and NPM updates via PRs, but the user may still want to update manually — especially for tooling (Tailwind, ESBuild, Sqlean) which Dependabot doesn't cover.

Workflow

1. Check what's outdated

Run mise run dev:outdated. Read the summary table at the end — it has three columns: Dependency, Status, and Next Step.

If mix dependencies are outdated, the output usually contains a hex.pm diff preview link (looks like https://hex.pm/l/FR8QK). Offer the user the option to open it in the browser for manual inspection before proceeding.

2. Assess the updates

Before running any update commands, check for major version bumps in the outdated output. For major bumps (e.g., 1.x → 2.x), look up the changelog or migration guide before updating — breaking changes may require code modifications.

If nothing is outdated, stop here and tell the user.

3. Apply updates

For each outdated category, run the command from the Next Step column. You have two options depending on what the user prefers:

• Bulk update: run mise run dev:update to update everything at once.
• Selective update: run individual commands from the summary table one at a time.

When in doubt, ask the user which approach they prefer.

4. Verify

Run these checks after updating:

1. mise run dev:outdated — confirm everything is now up to date
2. mix compile — catch compilation errors early
3. mix assets.build — verify JS/CSS builds succeed (this depends on compiled Elixir code, so it must run after mix compile). This matters because NPM, Tailwind, and ESBuild updates can break the asset pipeline.
4. mise run dev:lint — catch formatting or credo issues introduced by updates
5. mix test — verify nothing is broken

5. Commit

Follow the project's commit conventions.

If a major version bump required code changes, those changes belong in the same commit as the dependency bump — not in a separate commit.