Dependency Wrangler

A Claude Code plugin marketplace for researching dependency upgrades before changing code.

Installation

/plugin marketplace add bastidood/dependency-wrangler
/plugin install dependabump@dependency-wrangler
/reload-plugins

Dependabump

Dependabump discovers outdated direct dependencies, collects authoritative release information in parallel, and analyzes the repository for upgrade hazards. It produces an evidence-backed report without modifying manifests, lockfiles, source code, branches, commits, or pull requests.

Invoke the entry point with one package manager and describe the desired scope in prose:

/dependabump:bump-dependencies Check every outdated pnpm dependency.
/dependabump:bump-dependencies Check only major Cargo upgrades.
/dependabump:bump-dependencies Check patch and minor npm upgrades for react and vite in packages/web.

One run supports exactly one package manager. Dependabump analyzes every patch, minor, and major upgrade by default. A stated severity filter and package allowlist narrow the result together. All workspace members are included unless the request identifies a narrower scope.

Supported package managers:

• npm
• pnpm
• Yarn Classic (Yarn Berry is not supported)
• Bun
• Deno, including JSR and npm dependencies
• uv
• Cargo

If the repository contains multiple active package managers and the request does not identify one unambiguously, Dependabump asks for a single manager or narrower working directory before continuing.

Workflow

flowchart TD
    entry["/bump-dependencies"] --> discover["Discover outdated<br/>direct dependencies"]
    discover --> empty{"Any matching<br/>upgrades?"}
    empty -- No --> stop["Stop without creating artifacts"]
    empty -- Yes --> fanout{"Research packages<br/>in parallel"}
    fanout --> changelogA["Package changelog"]
    fanout --> changelogB["Package changelog"]
    fanout --> changelogN["Package changelog"]
    changelogA --> assess["Analyze repository impact"]
    changelogB --> assess
    changelogN --> assess
    assess --> report["Dependency upgrade<br/>impact report"]

For each package, release research checks GitHub releases first, then common changelog files, package-local release notes, migration guides, and official announcements. The final analysis searches repository-owned code for:

• Breaking API, configuration, runtime, and behavior changes
• Required migrations and used deprecations
• Future deprecation hazards
• Local workarounds made obsolete by upstream fixes
• Changes that require manual validation

Each package receives one verdict: Safe to Bump, Changes Required, or Needs Attention.

Generated Artifacts

Dependabump writes research results beneath .dependabump/:

.dependabump/
├── changelogs/
│   └── *.md
└── impact.md

Add .dependabump/ to the target repository's .gitignore when these reports should remain local.

If .dependabump/ already contains data, Dependabump lists the generated paths and asks before replacing the directory. When discovery finds no outdated dependencies—or no dependency matches the requested filters—it stops without creating or replacing .dependabump/.