Dependency Wrangler

A Claude Code plugin marketplace for dependency management tools.

Installation

/plugin marketplace add bastidood/dependency-wrangler
/plugin install dependabump@dependency-wrangler

Plugins

Dependabump

Orchestrates dependency bumping across package managers: npm, pnpm, yarn, bun, uv, and cargo.

/dependabump:bump-dependencies <package-manager>

Flag	Effect
--root-only	Scan only the root, ignoring workspace members
--include-major	Include major version bumps (deferred by default)
--include-patch	Analyze patch bumps (assumed safe by default)

The workflow detects outdated packages, scrapes changelogs, assesses codebase impact, proposes a staged upgrade plan ordered from safest to riskiest, and drafts a pull request that applies the safe, backward-compatible bumps while summarizing the deferred and breaking-change work staged in plan.md for follow-up.

Warning

Running this workflow across ~20 dependencies can consume up to half of the 5-hour rate limits in a $100 Claude Max subscription. With ~40 parallelized dependencies, you may even hit rate limits on a single run entirely.

This is why the --include-major and --include-patch flags are disabled by default. Typically, most unexpected breaking changes occur in minor version bumps anyway.

But, it's still better to not be in this situation in the first place. When it comes to dependency management, it's far easier to keep up than catch up.

flowchart TD
    orchestrator["/dependabump:bump-dependencies"] --> finder

    finder["Dependency Finder
    (Haiku)"]
    finder -- outdated keyset --> fan_out

    fan_out{"Map: fan-out per dependency"}
    fan_out -- "dep-1" --> scraper_1["Changelog Scraper
    (Sonnet)"]
    fan_out -- "dep-2" --> scraper_2["Changelog Scraper
    (Sonnet)"]
    fan_out -- "dep-N" --> scraper_n["Changelog Scraper
    (Sonnet)"]
    scraper_1 --> join{"Reduce: join"}
    scraper_2 --> join
    scraper_n --> join

    join -- changelogs --> assessor["Impact Assessor
    (Opus)"]
    assessor -- impact --> planner["Refactor Planner
    (Sonnet)"]
    planner -- plan.md --> drafter["PR Drafter
    (Sonnet)"]
    assessor -. impact .-> drafter
    finder -. outdated .-> drafter
    drafter -- safe bumps + deferred summary --> present([pull-request.md])
    planner -. refactors: follow-up PR .-> followup([separate PR])

Loading

Intermediate results are written to a .dependabump/ scratch directory. Please add this to your .gitignore file.

.dependabump/
├── outdated.md     # normalized outdated-dependency report
├── changelogs/*.md # per-package changelog summaries
├── impact.md       # consolidated codebase impact report
├── plan.md         # staged upgrade plan
└── pull-request.md # drafted pull-request description: safe bumps + deferred summary (final artifact)

Prerequisites

• The GitHub CLI: gh
• The package manager you intend to bump: npm, pnpm, cargo + cargo-outdated, uv, etc.