dependency-migration-triage
Rigorously triage a single Dependabot (or Renovate) dependency version-bump PR: pull the real changelog/release notes across the full old->new version range (not the PyPI summary blurb), always read the actual source diff between the two tags as well - a changelog records what changed and can never record what stayed the same, which is what most "we are unaffected" arguments actually rest on - map both against actual usage sites in this codebase, write a migration plan that distinguishes API-signature changes from conceptual/behavioral ones (a version bump can quietly change defaults or strictness with no signature change at all), verify whether existing tests would actually catch a regression in that exact spot or merely execute the line with stale data, write a regression test that fails on the old behavior when a real issue is found, fix what's fixable, and open a PR mirroring the migration that links back to the originating Dependabot PR. Use this whenever the user wants to review, assess, migrate, or avo
SKILL.md
The description above is the indexed summary. With JavaScript enabled, this page also loads the SKILL.md text from GitHub.