[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6ADE01NG4W26CKV48MBYRX6":3,"skill-same:01M6ADE01NG4W26CKV48MBYRX6":64},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":36,"linkOnly":37,"markdownContent":38,"markdownBody":39,"frontMatter":40,"refName":42,"commitSha":43,"skillDirectory":44,"forksCount":45,"repositoryHtmlUrl":46,"repositoryHomepageUrl":6,"ownerHtmlUrl":47,"ownerBlogUrl":48,"ownerDescription":49,"updatedAt":50,"install":51,"resources":63},"01M6ADE01NG4W26CKV48MBYRX6","update-deps",null,"Keep dependencies up-to-date. Discovers outdated deps via dependabot alerts\u002FPRs, creates one PR per ecosystem, iterates until CI is green, then assigns for review.","github\u002Frust-gems","github","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F9919?v=4","01M6AC83DS133TPXFSP1DHNCC6","GitHub","01M6ADDY6BHSGW24YSJAY3WBE5",137,"MIT","https:\u002F\u002Fgithub.com\u002Fgithub\u002Frust-gems\u002Fblob\u002Fmain\u002F.github\u002Fskills\u002Fupdate-deps\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35],"update","update deps","deps","dependencies","prs","for","true","ecosystem","keep","via","alerts","green","review","up","dependabot","ci","pr","2026-11-10 10:12:30",false,"---\nname: update-deps\ndescription: Keep dependencies up-to-date. Discovers outdated deps via dependabot alerts\u002FPRs, creates one PR per ecosystem, iterates until CI is green, then assigns for review.\nuser-invocable: true\n---\n\n# Update Dependencies\n\nAutomate the full dependency update lifecycle: discover what's outdated, apply updates grouped by ecosystem, fix breakage, get CI green, and hand off for human review.\n\n## Repository context\n\nThis is a Rust workspace containing utility crates published to crates.io. All dependency update PRs target the **`main`** branch.\n\nDependabot is configured (`.github\u002Fdependabot.yaml`) to open PRs against `main` on the 2nd of each month. This skill gathers individual dependabot PRs, combines updates by ecosystem, fixes any breakage, gets CI green, and creates consolidated PRs for human review.\n\n### Crates in this workspace\n\n| Crate | Description |\n|---|---|\n| **bpe** | Fast byte-pair encoding |\n| **bpe-openai** | OpenAI tokenizers built on bpe |\n| **geo_filters** | Probabilistic cardinality estimation |\n| **string-offsets** | UTF-8\u002FUTF-16\u002FUnicode position conversion (with WASM\u002FJS bindings) |\n\nSupporting packages (not published): `bpe-tests`, `bpe-benchmarks`.\n\n### Ecosystems in this repo\n\n| Ecosystem | Directories | Notes |\n|---|---|---|\n| **cargo** | `\u002F` (workspace root) | Deps declared per-crate; `Cargo.lock` at workspace root pins versions |\n| **github-actions** | `.github\u002Fworkflows\u002F` | CI and publish workflows |\n| **npm** | `crates\u002Fstring-offsets\u002Fjs\u002F` | JS bindings for string-offsets (WASM) |\n\n### Build and validation commands\n\n```bash\nmake build     # cargo build --all-targets --all-features\nmake build-js  # npm run compile in crates\u002Fstring-offsets\u002Fjs\nmake lint      # cargo fmt --check + cargo clippy (deny warnings, forbid unwrap_used)\nmake test      # cargo test + doc tests\n```\n\nCI runs on `ubuntu-latest` with the `mold` linker. The lint job depends on build.\n\n## Workflow\n\n### 1. Assess repo state\n\nDetermine the repo identity and confirm the target branch.\n\n```bash\ngit remote get-url origin   # extract owner\u002Frepo\ngit fetch origin main\ngit rev-parse --verify origin\u002Fmain\n```\n\nDetect which ecosystems have pending updates:\n\n```bash\n[ -f Cargo.toml ] && echo \"cargo\"\nls .github\u002Fworkflows\u002F*.yml .github\u002Fworkflows\u002F*.yaml 2>\u002Fdev\u002Fnull && echo \"github-actions\"\n[ -f crates\u002Fstring-offsets\u002Fjs\u002Fpackage.json ] && echo \"npm\"\n```\n\nReport discovered ecosystems to the user.\n\n### 2. Gather dependency intelligence\n\nFetch open dependabot PRs:\n\n```bash\ngh pr list --author 'app\u002Fdependabot' --base main --state open --json number,title,headRefName,labels --limit 100\n```\n\nFetch open dependabot alerts:\n\n```bash\ngh api --paginate \u002Frepos\u002F{owner}\u002F{repo}\u002Fdependabot\u002Falerts --jq '[.[] | select(.state==\"open\") | {number: .number, package: .security_vulnerability.package.name, ecosystem: .security_vulnerability.package.ecosystem, severity: .security_advisory.severity, summary: .security_advisory.summary}]'\n```\n\nFor ecosystems without dependabot coverage or when running ad-hoc, use native tooling:\n\n- **cargo:** `cargo update --dry-run`\n- **npm:** find directories containing `package.json`, then run `npm outdated --json || true` in each (npm exits non-zero when updates exist)\n\nAlso fetch the advisory URLs for any security-related updates. Individual alert details are at `https:\u002F\u002Fgithub.com\u002F{owner}\u002F{repo}\u002Fsecurity\u002Fdependabot\u002F{alert_number}`. Fetch alert numbers and GHSA IDs via:\n\n```bash\ngh api --paginate \u002Frepos\u002F{owner}\u002F{repo}\u002Fdependabot\u002Falerts --jq '[.[] | {number: .number, state, package: .security_vulnerability.package.name, ecosystem: .security_vulnerability.package.ecosystem, severity: .security_advisory.severity, ghsa_id: .security_advisory.ghsa_id, summary: .security_advisory.summary}]'\n```\n\nInclude both open and auto_dismissed\u002Fdismissed alerts — the update may resolve alerts in any state.\n\nCross-reference and group all updates by ecosystem. Present a summary to the user:\n\n- How many updates per ecosystem\n- Which have security alerts (with severity, GHSA IDs, and advisory links)\n- Which dependabot PRs already exist\n\n**Flag high-risk upgrades.** Before proceeding, explicitly call out upgrades that carry elevated risk:\n\n- **Major version bumps** — likely contain breaking API changes\n- **Packages with wide blast radius** — for this repo, pay special attention to: `serde`, `itertools`, `regex-automata`, `wasm-bindgen`, `criterion`, and the Rust toolchain itself\n- **Multiple major bumps in the same PR** — each major bump multiplies the risk; consider splitting them\n\nPresent the risk assessment to the user and recommend which upgrades to include vs. defer. When in doubt, prefer a smaller, safe update over an ambitious one that might break.\n\n### 3. Create branch and apply updates\n\nFor each selected ecosystem, starting from `main`:\n\n```bash\ngit checkout main\ngit pull origin main\ngit checkout -b deps\u002F{ecosystem}-updates-$(date +%Y-%m-%d)\n```\n\nApply updates using ecosystem-appropriate tooling:\n\n**cargo:**\n\n```bash\ncargo update\n# For major bumps, edit Cargo.toml version constraints then:\ncargo check\n```\n\nThis is a Cargo workspace — always run from the repo root. All crate `Cargo.toml` files are in `crates\u002F`. The `Cargo.lock` at the root is the single source of truth.\n\n**npm:**\n\n```bash\ncd crates\u002Fstring-offsets\u002Fjs\nnpm update\nnpm install\n```\n\n**github-actions:**\n\n- Parse workflow YAML files in `.github\u002Fworkflows\u002F` for `uses:` directives\n- For each action with an outdated version (from dependabot PRs\u002Falerts), update the SHA or version tag\n- Be careful to preserve comments and formatting\n\n### 4. Build, lint, and test locally\n\nAlways run:\n\n```bash\nmake lint      # cargo fmt --check + clippy with deny warnings\nmake test      # cargo test with backtrace\nmake build     # full workspace build (all targets, all features)\n```\n\nIf npm dependencies changed:\n\n```bash\nmake build-js  # npm compile for string-offsets JS binding\n```\n\n**If the build\u002Flint\u002Ftest fails:**\n\n1. Read the error output carefully\n2. Analyze what broke — likely API changes, type errors, or deprecation removals\n3. Make the necessary code changes to fix the breakage\n4. Run the pipeline again\n5. Repeat up to 3 times\n\nIf still failing after 3 iterations, report the situation to the user and ask for guidance. Do not push broken code.\n\n### 5. Commit and push\n\nStage all changes and commit with a descriptive message:\n\n```bash\ngit add -A\ngit commit -m \"chore(deps): update {ecosystem} dependencies\n\nUpdated packages:\n- package-a: 1.0.0 → 2.0.0\n- package-b: 3.1.0 → 3.2.0\n\n{If code changes were needed:}\nFixed breaking changes:\n- Updated X API usage for package-a v2\n\nSupersedes: #{dependabot_pr_1}, #{dependabot_pr_2}\n\"\n```\n\nPush the branch:\n\n```bash\ngit push -u origin HEAD\n```\n\n### 6. Create the PR\n\n**Title:** `chore(deps): update {ecosystem} dependencies`\n\n**Body should include:**\n\n- List of updated dependencies with version changes (old → new)\n- Any security alerts resolved — for each, link to the specific dependabot alert (`https:\u002F\u002Fgithub.com\u002F{owner}\u002F{repo}\u002Fsecurity\u002Fdependabot\u002F{alert_number}`) and the GHSA advisory (`https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-xxxx-xxxx-xxxx`), along with severity and summary\n- **High-risk changes flagged for reviewer attention** (major version bumps, wide-blast-radius packages)\n- Code changes made to fix breakage (if any)\n- References to superseded dependabot PRs\n- Note that this was generated by the update-deps skill\n\nWrite the body to a temp file and create the PR **targeting `main`**:\n\n```bash\ngh pr create --title \"chore(deps): update {ecosystem} dependencies\" --body-file \u002Ftmp\u002Fdeps-pr-body.md --base main\nrm \u002Ftmp\u002Fdeps-pr-body.md\n```\n\n### 7. Monitor CI and iterate on failures\n\nWatch the PR's checks:\n\n```bash\ngh pr checks {pr_number} --watch --fail-fast\n```\n\n**If checks fail:**\n\n1. Get the failed run details:\n\n```bash\ngh run list --branch {branch} --status failure --json databaseId,name --limit 1\ngh run view {run_id} --log-failed\n```\n\n2. Analyze the failure — CI runs on `ubuntu-latest` with `mold` linker, which may differ from local builds.\n\n3. Fix the issue locally, commit, and push:\n\n```bash\ngit add -A\ngit commit -m \"fix: resolve CI failure in {ecosystem} dep update\n\n{Brief description of what failed and why}\"\ngit push\n```\n\n4. Monitor again. Repeat up to 3 iterations total.\n\n5. If still failing after 3 pushes, report to the user with the failure details and ask for help.\n\n### 8. Close superseded dependabot PRs\n\nFor each dependabot PR that this update supersedes:\n\n```bash\ngh pr close {dependabot_pr_number} --comment \"Superseded by #{new_pr_number} which includes this update along with other {ecosystem} dependency updates.\"\n```\n\n### 9. Assign for review\n\nRequest review from CODEOWNERS or a user-provided reviewer (not the PR author):\n\n```bash\ngh pr edit {pr_number} --add-reviewer {reviewer_login}\n```\n\nReport the final PR URL and a summary of what was done.\n\n## Guidelines\n\n- **All PRs target `main`.** There is no separate dev branch.\n- **Never push to `main` directly.** Always work on a feature branch.\n- **Never push code that doesn't pass `make lint` and `make test`.** If you can't fix it in 3 tries, stop and ask.\n- **Be conservative with major version bumps.** If a major version update breaks things and the fix isn't obvious, skip that package and note it in the PR description.\n- **Regenerate lockfiles.** Always regenerate `Cargo.lock` and `package-lock.json` after updating — don't just edit manifests.\n- **One ecosystem at a time.** Complete the full cycle (update → build → push → PR → CI green) for one ecosystem before moving to the next.\n- **If no updates are needed** for an ecosystem, skip it and tell the user.\n- **Security alerts take priority.** Address security alerts first within each ecosystem.\n- **Clippy is strict.** This repo forbids `unwrap_used` outside tests and denies all warnings. New dependency versions may trigger new clippy lints — fix them.\n\n## Edge cases\n\n- **Cargo workspace:** Dependencies are declared per-crate but share a single `Cargo.lock` at the workspace root. Always run `cargo update` and `cargo check` from the repo root.\n- **npm:** Look for `package.json` files to discover npm packages rather than hardcoding paths — the repo layout may change.\n- **WASM builds:** After updating `wasm-bindgen` or related deps, verify `make build-js` still works — WASM toolchain version mismatches are common.\n- **Rate limits:** If `gh api` hits rate limits, wait and retry. Report to user if persistent.\n- **Nothing to update:** Report cleanly and move to the next ecosystem (or exit).\n- **Merge conflicts on push:** Rebase on `main` and retry: `git fetch origin main && git rebase origin\u002Fmain`.\n- **Branch already exists:** If `deps\u002F{ecosystem}-updates-{date}` already exists, append a counter or ask user.\n","# Update Dependencies\n\nAutomate the full dependency update lifecycle: discover what's outdated, apply updates grouped by ecosystem, fix breakage, get CI green, and hand off for human review.\n\n## Repository context\n\nThis is a Rust workspace containing utility crates published to crates.io. All dependency update PRs target the **`main`** branch.\n\nDependabot is configured (`.github\u002Fdependabot.yaml`) to open PRs against `main` on the 2nd of each month. This skill gathers individual dependabot PRs, combines updates by ecosystem, fixes any breakage, gets CI green, and creates consolidated PRs for human review.\n\n### Crates in this workspace\n\n| Crate | Description |\n|---|---|\n| **bpe** | Fast byte-pair encoding |\n| **bpe-openai** | OpenAI tokenizers built on bpe |\n| **geo_filters** | Probabilistic cardinality estimation |\n| **string-offsets** | UTF-8\u002FUTF-16\u002FUnicode position conversion (with WASM\u002FJS bindings) |\n\nSupporting packages (not published): `bpe-tests`, `bpe-benchmarks`.\n\n### Ecosystems in this repo\n\n| Ecosystem | Directories | Notes |\n|---|---|---|\n| **cargo** | `\u002F` (workspace root) | Deps declared per-crate; `Cargo.lock` at workspace root pins versions |\n| **github-actions** | `.github\u002Fworkflows\u002F` | CI and publish workflows |\n| **npm** | `crates\u002Fstring-offsets\u002Fjs\u002F` | JS bindings for string-offsets (WASM) |\n\n### Build and validation commands\n\n```bash\nmake build     # cargo build --all-targets --all-features\nmake build-js  # npm run compile in crates\u002Fstring-offsets\u002Fjs\nmake lint      # cargo fmt --check + cargo clippy (deny warnings, forbid unwrap_used)\nmake test      # cargo test + doc tests\n```\n\nCI runs on `ubuntu-latest` with the `mold` linker. The lint job depends on build.\n\n## Workflow\n\n### 1. Assess repo state\n\nDetermine the repo identity and confirm the target branch.\n\n```bash\ngit remote get-url origin   # extract owner\u002Frepo\ngit fetch origin main\ngit rev-parse --verify origin\u002Fmain\n```\n\nDetect which ecosystems have pending updates:\n\n```bash\n[ -f Cargo.toml ] && echo \"cargo\"\nls .github\u002Fworkflows\u002F*.yml .github\u002Fworkflows\u002F*.yaml 2>\u002Fdev\u002Fnull && echo \"github-actions\"\n[ -f crates\u002Fstring-offsets\u002Fjs\u002Fpackage.json ] && echo \"npm\"\n```\n\nReport discovered ecosystems to the user.\n\n### 2. Gather dependency intelligence\n\nFetch open dependabot PRs:\n\n```bash\ngh pr list --author 'app\u002Fdependabot' --base main --state open --json number,title,headRefName,labels --limit 100\n```\n\nFetch open dependabot alerts:\n\n```bash\ngh api --paginate \u002Frepos\u002F{owner}\u002F{repo}\u002Fdependabot\u002Falerts --jq '[.[] | select(.state==\"open\") | {number: .number, package: .security_vulnerability.package.name, ecosystem: .security_vulnerability.package.ecosystem, severity: .security_advisory.severity, summary: .security_advisory.summary}]'\n```\n\nFor ecosystems without dependabot coverage or when running ad-hoc, use native tooling:\n\n- **cargo:** `cargo update --dry-run`\n- **npm:** find directories containing `package.json`, then run `npm outdated --json || true` in each (npm exits non-zero when updates exist)\n\nAlso fetch the advisory URLs for any security-related updates. Individual alert details are at `https:\u002F\u002Fgithub.com\u002F{owner}\u002F{repo}\u002Fsecurity\u002Fdependabot\u002F{alert_number}`. Fetch alert numbers and GHSA IDs via:\n\n```bash\ngh api --paginate \u002Frepos\u002F{owner}\u002F{repo}\u002Fdependabot\u002Falerts --jq '[.[] | {number: .number, state, package: .security_vulnerability.package.name, ecosystem: .security_vulnerability.package.ecosystem, severity: .security_advisory.severity, ghsa_id: .security_advisory.ghsa_id, summary: .security_advisory.summary}]'\n```\n\nInclude both open and auto_dismissed\u002Fdismissed alerts — the update may resolve alerts in any state.\n\nCross-reference and group all updates by ecosystem. Present a summary to the user:\n\n- How many updates per ecosystem\n- Which have security alerts (with severity, GHSA IDs, and advisory links)\n- Which dependabot PRs already exist\n\n**Flag high-risk upgrades.** Before proceeding, explicitly call out upgrades that carry elevated risk:\n\n- **Major version bumps** — likely contain breaking API changes\n- **Packages with wide blast radius** — for this repo, pay special attention to: `serde`, `itertools`, `regex-automata`, `wasm-bindgen`, `criterion`, and the Rust toolchain itself\n- **Multiple major bumps in the same PR** — each major bump multiplies the risk; consider splitting them\n\nPresent the risk assessment to the user and recommend which upgrades to include vs. defer. When in doubt, prefer a smaller, safe update over an ambitious one that might break.\n\n### 3. Create branch and apply updates\n\nFor each selected ecosystem, starting from `main`:\n\n```bash\ngit checkout main\ngit pull origin main\ngit checkout -b deps\u002F{ecosystem}-updates-$(date +%Y-%m-%d)\n```\n\nApply updates using ecosystem-appropriate tooling:\n\n**cargo:**\n\n```bash\ncargo update\n# For major bumps, edit Cargo.toml version constraints then:\ncargo check\n```\n\nThis is a Cargo workspace — always run from the repo root. All crate `Cargo.toml` files are in `crates\u002F`. The `Cargo.lock` at the root is the single source of truth.\n\n**npm:**\n\n```bash\ncd crates\u002Fstring-offsets\u002Fjs\nnpm update\nnpm install\n```\n\n**github-actions:**\n\n- Parse workflow YAML files in `.github\u002Fworkflows\u002F` for `uses:` directives\n- For each action with an outdated version (from dependabot PRs\u002Falerts), update the SHA or version tag\n- Be careful to preserve comments and formatting\n\n### 4. Build, lint, and test locally\n\nAlways run:\n\n```bash\nmake lint      # cargo fmt --check + clippy with deny warnings\nmake test      # cargo test with backtrace\nmake build     # full workspace build (all targets, all features)\n```\n\nIf npm dependencies changed:\n\n```bash\nmake build-js  # npm compile for string-offsets JS binding\n```\n\n**If the build\u002Flint\u002Ftest fails:**\n\n1. Read the error output carefully\n2. Analyze what broke — likely API changes, type errors, or deprecation removals\n3. Make the necessary code changes to fix the breakage\n4. Run the pipeline again\n5. Repeat up to 3 times\n\nIf still failing after 3 iterations, report the situation to the user and ask for guidance. Do not push broken code.\n\n### 5. Commit and push\n\nStage all changes and commit with a descriptive message:\n\n```bash\ngit add -A\ngit commit -m \"chore(deps): update {ecosystem} dependencies\n\nUpdated packages:\n- package-a: 1.0.0 → 2.0.0\n- package-b: 3.1.0 → 3.2.0\n\n{If code changes were needed:}\nFixed breaking changes:\n- Updated X API usage for package-a v2\n\nSupersedes: #{dependabot_pr_1}, #{dependabot_pr_2}\n\"\n```\n\nPush the branch:\n\n```bash\ngit push -u origin HEAD\n```\n\n### 6. Create the PR\n\n**Title:** `chore(deps): update {ecosystem} dependencies`\n\n**Body should include:**\n\n- List of updated dependencies with version changes (old → new)\n- Any security alerts resolved — for each, link to the specific dependabot alert (`https:\u002F\u002Fgithub.com\u002F{owner}\u002F{repo}\u002Fsecurity\u002Fdependabot\u002F{alert_number}`) and the GHSA advisory (`https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-xxxx-xxxx-xxxx`), along with severity and summary\n- **High-risk changes flagged for reviewer attention** (major version bumps, wide-blast-radius packages)\n- Code changes made to fix breakage (if any)\n- References to superseded dependabot PRs\n- Note that this was generated by the update-deps skill\n\nWrite the body to a temp file and create the PR **targeting `main`**:\n\n```bash\ngh pr create --title \"chore(deps): update {ecosystem} dependencies\" --body-file \u002Ftmp\u002Fdeps-pr-body.md --base main\nrm \u002Ftmp\u002Fdeps-pr-body.md\n```\n\n### 7. Monitor CI and iterate on failures\n\nWatch the PR's checks:\n\n```bash\ngh pr checks {pr_number} --watch --fail-fast\n```\n\n**If checks fail:**\n\n1. Get the failed run details:\n\n```bash\ngh run list --branch {branch} --status failure --json databaseId,name --limit 1\ngh run view {run_id} --log-failed\n```\n\n2. Analyze the failure — CI runs on `ubuntu-latest` with `mold` linker, which may differ from local builds.\n\n3. Fix the issue locally, commit, and push:\n\n```bash\ngit add -A\ngit commit -m \"fix: resolve CI failure in {ecosystem} dep update\n\n{Brief description of what failed and why}\"\ngit push\n```\n\n4. Monitor again. Repeat up to 3 iterations total.\n\n5. If still failing after 3 pushes, report to the user with the failure details and ask for help.\n\n### 8. Close superseded dependabot PRs\n\nFor each dependabot PR that this update supersedes:\n\n```bash\ngh pr close {dependabot_pr_number} --comment \"Superseded by #{new_pr_number} which includes this update along with other {ecosystem} dependency updates.\"\n```\n\n### 9. Assign for review\n\nRequest review from CODEOWNERS or a user-provided reviewer (not the PR author):\n\n```bash\ngh pr edit {pr_number} --add-reviewer {reviewer_login}\n```\n\nReport the final PR URL and a summary of what was done.\n\n## Guidelines\n\n- **All PRs target `main`.** There is no separate dev branch.\n- **Never push to `main` directly.** Always work on a feature branch.\n- **Never push code that doesn't pass `make lint` and `make test`.** If you can't fix it in 3 tries, stop and ask.\n- **Be conservative with major version bumps.** If a major version update breaks things and the fix isn't obvious, skip that package and note it in the PR description.\n- **Regenerate lockfiles.** Always regenerate `Cargo.lock` and `package-lock.json` after updating — don't just edit manifests.\n- **One ecosystem at a time.** Complete the full cycle (update → build → push → PR → CI green) for one ecosystem before moving to the next.\n- **If no updates are needed** for an ecosystem, skip it and tell the user.\n- **Security alerts take priority.** Address security alerts first within each ecosystem.\n- **Clippy is strict.** This repo forbids `unwrap_used` outside tests and denies all warnings. New dependency versions may trigger new clippy lints — fix them.\n\n## Edge cases\n\n- **Cargo workspace:** Dependencies are declared per-crate but share a single `Cargo.lock` at the workspace root. Always run `cargo update` and `cargo check` from the repo root.\n- **npm:** Look for `package.json` files to discover npm packages rather than hardcoding paths — the repo layout may change.\n- **WASM builds:** After updating `wasm-bindgen` or related deps, verify `make build-js` still works — WASM toolchain version mismatches are common.\n- **Rate limits:** If `gh api` hits rate limits, wait and retry. Report to user if persistent.\n- **Nothing to update:** Report cleanly and move to the next ecosystem (or exit).\n- **Merge conflicts on push:** Rebase on `main` and retry: `git fetch origin main && git rebase origin\u002Fmain`.\n- **Branch already exists:** If `deps\u002F{ecosystem}-updates-{date}` already exists, append a counter or ask user.\n",{"name":5,"description":7,"user-invocable":41},true,"main","31331e8eeadf7e58f5af355a3881d95e9315ee32",".github\u002Fskills\u002Fupdate-deps",24,"https:\u002F\u002Fgithub.com\u002Fgithub\u002Frust-gems","https:\u002F\u002Fgithub.com\u002Fgithub","https:\u002F\u002Fgithub.com\u002Fabout","How people build software.","2026-11-11 10:52:28",{"source":8,"skillName":5,"commands":52,"prompt":62,"zipAvailable":41},[53,56,59],{"tool":54,"command":55},"npx","npx skills add github\u002Frust-gems --skill update-deps",{"tool":57,"command":58},"bunx","bunx skills add github\u002Frust-gems --skill update-deps",{"tool":60,"command":61},"pnpm","pnpm dlx skills add github\u002Frust-gems --skill update-deps","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fgithub\u002Frust-gems\u002Fblob\u002Fmain\u002F.github\u002Fskills\u002Fupdate-deps\u002FSKILL.md",[],[]]