Apply one governed bounded Proto UI dependency update after pui-deps establishes the exact manifest, lockfile, consumers, compatibility evidence, and rollback boundary. Use for ordinary package or toolchain updates whose intended compatibility is already fixed. Route unresolved public compatibility, security disclosure, publication, release, or provenance exceptions to their dedicated decision path.
Installs into .claude/skills of the current project.
Are you the author of Pui Dependency Update?
Add the live security badge to your README. It updates with every re-scan.
[](https://www.skillsdirectory.com/skills/proto-ui-pui-dependency-update)
---
name: pui-dependency-update
description: Apply one governed bounded Proto UI dependency update after pui-deps establishes the exact manifest, lockfile, consumers, compatibility evidence, and rollback boundary. Use for ordinary package or toolchain updates whose intended compatibility is already fixed. Route unresolved public compatibility, security disclosure, publication, release, or provenance exceptions to their dedicated decision path.
---
# Update one dependency slice
1. Require a current `pui-orient` `capability-envelope`, the exact `pui-deps` `dependency-report`, an applicable `pui-trace` `authority-map`, and `implementation-authorization` from the current bounded request, governed work item, or active standing scope. The dependency report does not replace the authority map.
2. Re-read every affected manifest and lockfile, the resolved package identity and provenance, direct and reverse consumers, package-manager policy, release surface, current advisory facts, and rollback boundary.
3. Confirm that current authority fixes the supported runtime range and compatibility result. A genuinely undecided public compatibility promise routes to `unresolved-product-direction`; security disclosure, publication, release, or a provenance exception routes to `privileged-or-irreversible-operation`.
4. Use Node.js 22 and the repository-declared pnpm through Corepack. Apply the smallest coherent manifest edit and let the package manager generate its lockfile projection; preserve unrelated resolutions and user changes.
5. Update direct compatibility evidence or consumer fixtures only when the dependency report includes them in the governed slice. Semantic changes owned by a Module, Host Capability, Adapter, Prototype, or regression route through that owning leaf.
6. Run frozen-install or lockfile integrity checks, focused consumer tests, type checks, and applicable release/package-surface checks. Record environmental limitations without converting them into product uncertainty.
7. Return the exact package identities before and after, actual diff, affected consumers, generated files, evidence, rollback command or revision boundary, residual risks, and one eligible validation or review handoff.
The transition changes tracked feature-branch content only. External publication and release remain outside this leaf.
## Explicit handoff
Return exactly one handoff conforming to `internal/agent-operations/schemas/skill-handoff.schema.json`. Carry `capability-envelope`, `dependency-report`, `authority-map`, and `implementation-authorization` by reference, preserving their existing references and any digests, and include the registered `candidate-change`. Set `nextSkillId` to one eligible registered leaf or `null` without loading it. Carry all artifacts required by that next leaf and validate the handoff before it is loaded; both `pui-validate` and `pui-review` require the existing authority map, and review additionally requires `evidence-report` and `review-input`.
Communicate with the user in the user's current language. Keep package names, versions, registries, and revision identities canonical.
