{"id":"agent-dev-dependency-update-pr","audience":"developers","category":"agents","track":"agents","technique":"constraints","title":"Brief a coding agent to update dependencies safely","free":false,"task":"You want a coding agent to handle this week's dependency updates. Write its brief: bump only patch and minor versions, keep express below 4.20 (bump it to 4.19.2, a known bug breaks your sessions), send any major version to you with ASK_HUMAN, run tests once after all bumps, open one PR and never merge. Output a plain-text numbered action log of at most 10 lines, ending with a DONE line listing the bumped packages.","materialLabel":"npm outdated output and actions (attached to your prompt automatically)","material":"$ npm outdated (repo: ledgerly-api)\n\nPackage   Current   Wanted    Latest\naxios     1.6.0     1.7.4     1.7.4    (security advisory: SSRF fix in 1.7.4)\nexpress   4.18.2    4.21.0    4.21.0\njest      29.5.0    29.7.0    29.7.0\nlodash    4.17.20   4.17.21   4.17.21\nreact     18.2.0    18.2.0    19.0.0\nzod       3.22.2    3.23.8    3.23.8\n\nAlso available on npm: express 4.19.2\n\nCI: GitHub Actions runs unit and integration tests on every PR (about 6 minutes). Branch protection: 1 approving review required before merge. Deploys to production go out automatically from main every hour.\n\nLast dependency PR (Oct 2): bumped zod and lodash, merged by Priya after review. The team channel is #ledgerly-dev.\n\nAvailable actions:\nbump(package, version)\nrun_tests()\nopen_pr(title, body)\nmerge_pr()\nASK_HUMAN(question)\nDONE(summary)","rules":[{"type":"maxBullets","max":10},{"type":"plainText"}],"promptHints":[{"label":"Limits to patch and minor","patterns":["patch","minor","major"]},{"label":"Pins express","patterns":["4\\.19","express"]},{"label":"Sets the order","patterns":["after (all|every|the) bump","then","order","before open"]},{"label":"Forbids merging","patterns":["merge"]},{"label":"Shows the action-log format","patterns":["action:","action log","numbered","\\b1\\.","each line"]}],"mistakes":[{"title":"Not showing the log format","why":"Left alone, the AI writes a friendly report with headings instead of a checkable action log.","fix":"Show it literally: \"Format every line like 1. ACTION: tool(args), then ASK_HUMAN: and DONE: lines. Plain text.\"","checks":["maxBullets","plainText"]},{"title":"Not pinning the known problem","why":"The AI takes the latest version of everything, including the express release that breaks your sessions.","fix":"Add: \"Bump express to 4.19.2 only, nothing 4.20 or newer.\"","checks":["r0"]},{"title":"No order or stop rule","why":"The AI may open the PR before testing, take the major React jump, or merge when CI passes.","fix":"Add: \"Majors go to ASK_HUMAN. Run tests after all bumps, then open one PR. Never merge.\"","checks":["r1"]},{"title":"No finish line","why":"Without a done rule the summary is vague.","fix":"Say: \"End with DONE listing each bumped package.\"","checks":["r2"]}],"hint":"Agents follow the newest-is-best default. Tell it which versions are off limits, the order to work in, and where its job ends.","rubricLabels":["Bumps axios, jest, lodash and zod to their latest versions and express to 4.19.2 (not 4.21.0), and does not bump react","React 19 is raised in an ASK_HUMAN line, run_tests comes after every bump and before open_pr, and there is no merge_pr line","The last line is a DONE line listing the bumped packages"]}