dependency-update-bot

​

Install

npx "@opendirectory.dev/skills" install dependency-update-bot --target claude

npx skills add Varnan-Tech/opendirectory --skill dependency-update-bot

/plugin marketplace add Varnan-Tech/opendirectory
/plugin install opendirectory-gtm-skills@opendirectory-marketplace

​

What It Does

• Runs npm outdated --json or pip list --outdated to find outdated packages
• Classifies each update as patch (low risk), minor (medium risk), or major (high risk) using semver
• Fetches changelogs from GitHub Releases, CHANGELOG.md, or npm/PyPI registry as fallback
• Uses Gemini to summarize what changed between old and new versions, flagging breaking changes
• Creates a branch per risk group, updates the package file, and opens a PR with the changelog summary
• Opens one PR per major update (since each major bump needs individual review)

​

Requirements

​

Setup

cp .env.example .env

• GEMINI_API_KEY (required)
• GITHUB_TOKEN (optional, increases GitHub API rate limit from 60 to 5,000 requests/hour)

​

How to Use

"Check for outdated packages"
"Update my dependencies and open PRs"
"Run the dependency update bot"

"Check my Python packages for updates"
"Scan requirements.txt for outdated dependencies"

"Only open PRs for patch updates today"
"Show me which packages have major version updates"

​

PR Structure

• Risk level label (patch / minor / major)
• For each package: version bump, changelog summary (3-5 bullets), breaking changes flagged with BREAKING prefix
• How to verify section

​

Risk Classification

​

Changelog Sources

1. GitHub Releases API (best)
2. Raw CHANGELOG.md from the repo
3. npm registry README (fallback)
4. PyPI project description (last resort)

​

Project Structure

dependency-update-bot/
├── SKILL.md
├── README.md
├── .env.example
├── evals/
│   └── evals.json
└── references/
    └── changelog-patterns.md

​

License