Dependency currency

Keeps the dependencies a Change touches current and in line with the org's library preferences, applying safe bumps and proposing major ones.

Name	dependency-currency
Category	Change review
Enabled by default	Yes
Budget	up to $4.00 per run, 60 turns
Catalog	v0.2.0
Used in	Change

What it does

Every Change leaves its dependencies no staler than it found them and uses the libraries the org prefers. The dependency currency role is accountable for applying patch and minor bumps with passing tests, proposing major bumps with a migration note, and flagging any new dependency that duplicates one the org already standardized on.

Step by step:

1. List every direct dependency the Change adds or bumps, and every direct dependency of the modules the Change edits, with the installed version and the latest available version.
2. Compare each new dependency against the library preferences in your opinions. When it duplicates a preferred library, rewrite the Change to use the preferred one if the swap is small, or note it for the builder.
3. Apply patch and minor bumps for the dependencies in scope, regenerate the lockfile with the project's own tool, and run the unit tests.
4. Revert any bump whose tests fail and record the failing test and the version that broke it.
5. For each available major bump, read the upstream changelog and write a short migration note: what breaks, what the Change would need to do, and an estimate. Open it as a proposal issue rather than applying it.
6. Commit each bump as its own commit on the Change branch, with the old and new version in the message.
7. Post one pull request comment with a table of what was bumped, what was held back and why, and what was proposed.
8. Finish with exactly one verdict: CHANGED (you committed bumps or swaps), NO CHANGE NEEDED (everything in scope is current and preferred), or BLOCKED (a required bump cannot be applied without a human decision).

When it runs

• On every Change. Runs on every Change, after the lint fixer.

What it reads

Source	What it uses it for
diff	The Change's diff, to find which dependencies and modules are in scope.
repo	Manifests and lockfiles (go.mod, package.json, pyproject.toml, Chart.yaml) at the Change's head commit.
registries	Latest versions and changelogs from the package registries in the allowlist.
advisories	Advisory data, so a security fix is never held back as an optional bump.

What it produces

• Bump commits on the Change branch, one per dependency, with regenerated lockfiles.
• A pull request comment with bumped, held back and proposed tables.
• One proposal issue per major bump, with a migration note and estimate.

How it proves it

Every run attaches this evidence to its AgentWorkflowRun step.

Evidence	What it shows	Required
Report	Dependency table with package, installed version, latest version, action taken and reason.	Yes
Log	Unit test output after the bumps were applied.	Yes
Diff	The manifest and lockfile changes the role committed.	No
Comment	Pull request comment summarizing bumps and proposals.	Yes

Success criteria

A run succeeds only when every statement holds.

• Every dependency in scope appears in the report with an action and a reason.
• Unit tests pass after every committed bump.
• No major version bump is applied without a human decision; each has a proposal issue instead.
• No new dependency duplicates a preferred library without being called out.
• Lockfiles are regenerated by the project's own tool, never edited by hand.
• Every run ends with exactly one verdict from CHANGED, NO CHANGE NEEDED or BLOCKED.

Guardrails

• Never apply a major version bump; propose it.
• Never edit a lockfile by hand.
• Never add a dependency the Change did not already need, except as a direct swap to a preferred library.
• Never pin to a pre-release, release candidate or git commit unless the Change already did.
• Never disable or skip a test to make a bump pass; revert the bump instead.
• Never bump dependencies outside the Change's scope; a repo-wide sweep is a separate Change.
• Never approve, merge or dismiss a review on the Change.

Permissions

Deny wins over allow.

Tools allowed	Read, Grep, Glob, Edit, Bash(git diff:*), Bash(git log:*), Bash(git commit:*), Bash(go get:*), Bash(go mod tidy:*), Bash(go list:*), Bash(go test:*), Bash(npm install:*), Bash(npm outdated:*), Bash(npm test:*), Bash(uv lock:*), Bash(helm dependency update:*)
Tools denied	Bash(git push --force:*), Bash(git reset --hard:*), Bash(gh pr merge:*), Bash(npm publish:*), Bash(rm -rf:*), Bash(kubectl:*)
Git scopes	contents:read, contents:write, pull_requests:write, issues:write
Cluster verbs	None
Network	allowlist
Egress allowlist	proxy.golang.org, sum.golang.org, registry.npmjs.org, pypi.org, files.pythonhosted.org, ghcr.io, api.github.com, github.com
May merge its own pull requests	No

When it hands off to a human

It dead-letters the work to @platform/reviewers if it has not finished after 45m, or as soon as any of these is true:

• A dependency with a security advisory has a fix only in a new major version.
• Two dependencies require incompatible versions of a shared transitive dependency.
• Tests fail on every available patch release of a dependency the Change needs.

Verdicts

Every run ends with exactly one of these verdicts:

• CHANGED
• NO CHANGE NEEDED
• BLOCKED

Opinions

Opinions are the org’s editable guidance for this role. Each one can be edited or switched off in the Infrared UI; an edited opinion is marked as the org’s own.

Which bumps we apply automatically

bump-policy · origin catalog

Apply patch and minor bumps automatically when tests pass. Propose major bumps as issues with a migration note. Security fixes are applied at whatever level is needed and escalated if that level is major.

Prefer the standard library

prefer-stdlib · origin catalog

Use the language's standard library before adding a dependency. In Go that means net/http, log/slog, encoding/json and testing. In TypeScript that means fetch, URL, crypto.randomUUID and structuredClone.

One library per job

one-per-job · origin catalog

One HTTP client, one logging library, one test framework, one schema validator per language. In Go: log/slog, testify for assertions, controller-runtime for Kubernetes. In TypeScript: vitest, zod, pino. A second library for the same job needs a written reason.

Only maintained dependencies

maintained-only · origin catalog

A dependency with no release in 18 months, an archived repo, or a deprecation notice is a candidate for replacement. Flag it in the comment even when no newer version exists.

Pin exact versions in applications

pin-exact · origin catalog

Applications pin exact versions through the lockfile. Libraries declare the widest range they are tested against. Container base images are pinned as tag@sha256.