elie222/update-packages
.claude/skills/update-packages/SKILL.md
Update workspace packages while respecting the repo's pinned package list in .ncurc.cjs. Use when the user asks to update dependencies or refresh package versions.
$ install --global
skillsauthnpx skillsauth add elie222/inbox-zero update-packagesInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Apr 15, 2026, 5:25 PM6.9s1 file scanned
SKILL.md
- name:
- update-packages
- description:
- Update workspace packages while respecting the repo's pinned package list in .ncurc.cjs. Use when the user asks to update dependencies or refresh package versions.
Update Packages
Use this workflow when updating dependencies in this repo.
Steps
- Check the pinned package list in
.ncurc.cjs. Do not upgrade packages listed there. - Keep the repo on Node 24. If you change Node runtime settings, update
.nvmrc,engines.node,@types/node, Dockerfiles, and CI together. - Update manifests across the workspace:
pnpm dlx npm-check-updates -u -ws
- Refresh the lockfile and install updated packages:
pnpm install
- Verify the update:
pnpm test
pnpm lint
Notes
npm-check-updatesreads.ncurc.cjs, so the reject list is applied during the manifest update.pnpm installmay also bump the rootpackageManagerfield and regeneratepnpm-lock.yaml.- Do not run
pnpm devorpnpm buildunless the user explicitly asks. - Keep
@hookform/resolversin the.ncurc.cjsreject list and pinned to4.1.0whileapps/webremains on[email protected]. The5.xresolver line importszod/v4/core, which has caused local Next.js/Turbopack resolution failures even though the app code still uses Zod 3.
Related Skills
elie222/inbox-zero-api
tools
VerifiedTrustedCommunity
Use the Inbox Zero API CLI to inspect the live API schema, list and manage automation rules, and read inbox analytics through the public API. Use this when a task involves Inbox Zero rules, stats, or API-driven automation and can be solved through the CLI instead of browser interaction.
10,455SKILL.mdUpdated Apr 15, 2026
elie222/write-tests
tools
VerifiedTrustedCommunity
Write focused unit tests for backend and utility logic
10,455SKILL.mdUpdated Apr 15, 2026
elie222/wait
testing
VerifiedTrustedCommunity
Pause execution for a user-specified duration
10,455SKILL.mdUpdated Apr 15, 2026
elie222/ui-components
documentation
VerifiedTrustedCommunity
UI component and styling guidelines using Shadcn UI, Radix UI, and Tailwind
10,455SKILL.mdUpdated Apr 15, 2026