Review project dependencies

---
name: "aboutcodex-dependency-review"
description: "Assess dependency updates for compatibility, security signals, and practical rollout risk. Use when the user asks to update, audit, or prioritize project dependencies."
---

# Review project dependencies

Assess dependency updates for compatibility, security signals, and practical rollout risk.

## Workflow

1. Read the manifest, lockfile, runtime constraints, and project validation commands.
2. Separate direct from transitive dependencies and identify the actual version delta.
3. Read official release notes and migration guides for meaningful behavior or requirement changes.
4. Update one coherent group at a time when authorized, preserving the lockfile tool.
5. Run focused and project-required checks, then record deferred upgrades with reasons.

Read `references/NOTES.md` before finalizing the work. Follow project instructions and the user's authorized scope. Use available evidence, label assumptions, and never report a check as passing unless it actually ran.

## Deliverable

A prioritized update plan or verified dependency change with rollback information. State material limitations and link to changed files or rendered evidence when available.