mcpField
1
1k-pkg-upgrade-review

1k-pkg-upgrade-review

github.com/onekeyhqTesting & quality2.5k54 installsUpdated today
Repository

About 1k-pkg-upgrade-review

A skill for teams reviewing npm or Yarn dependency upgrades. It diffs package source, traces project call sites, assesses compatibility risks, and produces a structured report.

Key features

  1. 01Diff source across package versions
  2. 02Classify API and behavior changes
  3. 03Find direct and indirect package usage
  4. 04Trace call sites and assess compatibility
  5. 05Generate a report and comment on the PR

Use cases

  1. 01Review Dependabot or Renovate updates
  2. 02Assess yarn.lock or package-lock.json changes
  3. 03Check compatibility of manual upgrades
  4. 04Understand package changes before merging

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/onekeyhq/app-monorepo --skill 1k-pkg-upgrade-review

After installing, type/1k-pkg-upgrade-reviewin Claude Code to confirm it loaded.

Bundled files

References and scripts installed along with SKILL.md.

agents/
openai.yaml
references/
example-report.md
references/rules/
report-template.md
review-workflow.md

Details

From the project README

Package Upgrade Review

Evaluates npm/yarn package version upgrades by performing source-level diff analysis, tracing all call sites, and producing a structured compatibility report.

Output language: Chinese (matching team conventions).

Quick Reference

TopicGuideDescription
Review workflowreview-workflow.mdStep-by-step review process
Report templatereport-template.mdOutput format and risk guidelines
Example reportexample-report.mdReal case: @isaacs/brace-expansion 5.0.0 -> 5.0.1

When to Use

  • Dependabot / Renovate PRs that bump dependency versions
  • Manual yarn upgrade or npm update changes
  • Any PR that modifies yarn.lock or package-lock.json
  • When team needs to understand what actually changed inside a package before merging

Workflow Overview

  1. Identify the package name and version range (old -> new)
  2. Download both versions from npm registry and extract
  3. Diff source code between versions (focus on JS/TS, not metadata)
  4. Classify changes: API signature, return value, new exports, removed exports, behavior changes
  5. Search project source code for direct imports/usage
  6. Search node_modules for indirect usage via intermediate packages
  7. Trace each call site to verify argument usage and compatibility
  8. Assess compatibility risks: signature, return type, return content, side effects
  9. Generate structured report to node_modules/.cache/pkg-upgrade/
  10. Post the full report as a PR comment via gh pr comment

Key Commands

# Download and extract both versions for diffing
mkdir -p /tmp/pkg-diff && cd /tmp/pkg-diff
curl -sL $(npm view PKG@OLD_VER dist.tarball) | tar xz -C old
curl -sL $(npm view PKG@NEW_VER dist.tarball) | tar xz -C new

# Compare file lists
diff -rq old/package new/package

# Diff main source
diff old/package/dist/commonjs/index.js new/package/dist/commonjs/index.js

# Search project code for direct usage
grep -r "PACKAGE_NAME" --include="*.ts" --include="*.tsx" --include="*.js" -l . \
  --exclude-dir=.git --exclude-dir=node_modules

# Search node_modules for indirect usage
grep -rn "from ['\"]PACKAGE_NAME['\"]" node_modules/ --include="*.js" --include="*.mjs" \
  | grep -v "node_modules/.cache"

# Check package metadata
npm view PKG@NEW_VER deprecated
npm view PKG@NEW_VER dist.integrity

Report Output

  • Local file: node_modules/.cache/pkg-upgrade/<package-name>-<old>-to-<new>.md
  • PR comment: The full report MUST also be posted as a comment on the PR via gh pr comment

Related Skills

  • /1k-code-review-pr - Comprehensive PR code review (security, code quality, platform patterns)

Comments

Markdown supported