skilldrop-cli 0.16.28 → 0.16.30

package/packs/dev-team/skills/dependency-upgrade-review/evals/files/4/pr.diff

@@ -0,0 +1,47 @@
+diff --git a/requirements.in b/requirements.in
+index 4b1c2e0..9a7d3f1 100644
+--- a/requirements.in
++++ b/requirements.in
+@@ -1,4 +1,4 @@
+ httpcore-lite==1.3.0
+-quillstream==2.4.1
++quillstream==3.1.0
+ pydantic-mini==0.9.2
+ structlog-tiny==4.0.1
+diff --git a/requirements.txt b/requirements.txt
+index 77e0a1d..c2f9b48 100644
+--- a/requirements.txt
++++ b/requirements.txt
+@@ -4,10 +4,10 @@
+ #
+ #    pip-compile --generate-hashes requirements.in
+ #
+-compat-six==1.16.2 \
+-    --hash=sha256:5926410f0515cd47563d23317bb234f19b519e17a61f630b3a7a3be2fbd023f3
+-    # via quillstream
++grainwire==1.0.0 \
++    --hash=sha256:ac5a05fbf6a38d80bb205b0640bfe3c886336e7fa936be0c57d323fe24f258ba
++    # via quillstream
+ httpcore-lite==1.3.0 \
+     --hash=sha256:993ac8ea6cc9be8463df390c480a245a090a3bba42ed538f9c8742d09ad7222a
+     # via
+     #   -r requirements.in
+     #   quillstream
+@@ -16,15 +16,15 @@ pydantic-mini==0.9.2 \
+     --hash=sha256:5411291f6c6c8ca714342bb4a421861331b89026a8318fa95c72043a8b6cfee7
+     # via -r requirements.in
+-quillstream==2.4.1 \
+-    --hash=sha256:7eb6637605fcb69f63cecd3000870f473af8aaaf41e5347ee3e80708a07561ca
++quillstream==3.1.0 \
++    --hash=sha256:e56b4c0d40fd62f44e33a53cc83ab388ac8edb6275eaac283afb2744bcd27c6d
+     # via -r requirements.in
+ structlog-tiny==4.0.1 \
+     --hash=sha256:1058a4589566f633cf2e795c7e5cfacdeb635d0b35e927619b4a437a1f6bdc01
+     # via -r requirements.in
+-typing-shimx==4.5.0 \
+-    --hash=sha256:0c8ab72efe0bd56117af955bfa741a49741395e2dfcd4ba688c941bda1cb963a
++typing-shimx==4.9.1 \
++    --hash=sha256:2e0970bbb5cd4ca819222abb76df78762fb1a7a0b3a98ee8fc38c3271cb7f450
+     # via
+     #   pydantic-mini
+     #   quillstream

package/packs/dev-team/skills/dependency-upgrade-review/evals/files/4/src/ingest/client.py

@@ -0,0 +1,24 @@
+from __future__ import annotations
+
+import time
+
+import structlog_tiny
+
+log = structlog_tiny.get_logger(__name__)
+
+MAX_ATTEMPTS = 3
+
+
+def fetch_with_retry(client, url: str):
+    """Fetch ``url``, retrying on timeout.
+
+    quillstream's ``Client.fetch`` returns ``None`` when the request times out.
+    """
+    for attempt in range(1, MAX_ATTEMPTS + 1):
+        result = client.fetch(url)
+        if result is None:
+            log.warning("quillstream fetch timed out", url=url, attempt=attempt)
+            time.sleep(2 ** attempt)
+            continue
+        return result
+    raise RuntimeError(f"gave up fetching {url} after {MAX_ATTEMPTS} attempts")

package/packs/dev-team/skills/dependency-upgrade-review/evals/files/4/src/ingest/reader.py

@@ -0,0 +1,32 @@
+"""Readers for the ingest pipeline.
+
+Current-format files go through ``read_stream``. Archived ``.qsf1`` files
+written before the 2024 migration are still replayed by the monthly backfill
+job through ``read_legacy_archive``.
+"""
+from __future__ import annotations
+
+from pathlib import Path
+from typing import Iterator
+
+import quillstream
+
+from .client import fetch_with_retry
+
+
+def read_stream(url: str) -> Iterator[bytes]:
+    client = quillstream.Client(timeout=10)
+    payload = fetch_with_retry(client, url)
+    yield from payload.chunks()
+
+
+def read_legacy_archive(path: Path) -> Iterator[bytes]:
+    # Imported lazily: only the backfill job needs the old frame format.
+    from quillstream.legacy import parse_frame
+
+    data = path.read_bytes()
+    offset = 0
+    while offset < len(data):
+        header, payload = parse_frame(data[offset:])
+        yield payload
+        offset += header.length

package/packs/dev-team/skills/dependency-upgrade-review/evals/files/4/tests/test_reader.py

@@ -0,0 +1,15 @@
+from unittest import mock
+
+from src.ingest import reader
+
+
+class FakePayload:
+    def chunks(self):
+        return [b"a", b"b"]
+
+
+def test_read_stream_yields_chunks():
+    fake_client = mock.Mock()
+    fake_client.fetch.return_value = FakePayload()
+    with mock.patch("quillstream.Client", return_value=fake_client):
+        assert list(reader.read_stream("qs://example/feed")) == [b"a", b"b"]

package/packs/dev-team/skills/dependency-upgrade-review/evals/files/4/upstream/quillstream-CHANGELOG.md

@@ -0,0 +1,37 @@
+# Changelog
+
+All notable changes to quillstream are documented here. This project follows Semantic Versioning.
+
+## 3.1.0 — 2026-10-11
+
+### Added
+- Frame decoding is now delegated to the new `grainwire` package (`grainwire>=1.0,<2`), which is a required dependency. `grainwire` ships compiled wheels for CPython 3.10–3.13 on manylinux and macOS; other platforms build from sdist and need a Rust toolchain.
+- `Client(..., compression="auto")` negotiates zstd when the server supports it.
+
+### Fixed
+- `Client.close()` no longer leaks a socket when called twice.
+
+## 3.0.0 — 2026-08-29
+
+### Breaking
+- **Python 3.10 or newer is required.** Support for Python 3.8 and 3.9 has been dropped (`python_requires=">=3.10"`).
+- **Removed the `quillstream.legacy` module**, deprecated since 2.2. `quillstream.legacy.parse_frame(buf)` is gone; use `quillstream.frames.decode(buf, strict=False)` instead. Note that `decode` returns a `Frame` object rather than a `(header, payload)` tuple; use `frame.header` and `frame.payload`.
+- `Client.fetch()` now raises `quillstream.errors.QuillTimeout` when the request times out. Previously it returned `None`.
+- Dropped the dependency on `compat-six`.
+
+### Changed
+- Minimum `typing-shimx` is now 4.8.
+
+## 2.5.0 — 2026-06-02
+
+### Deprecated
+- Importing `quillstream.legacy` now emits a `DeprecationWarning` with the removal version (3.0).
+- `Client.fetch()` returning `None` on timeout is deprecated; opt in to the 3.0 behaviour with `Client(raise_on_timeout=True)`.
+
+### Added
+- `quillstream.frames.decode()`.
+
+## 2.4.1 — 2026-03-17
+
+### Fixed
+- Off-by-one in chunked frame reassembly for payloads larger than 64 KiB.

package/packs/dev-team/skills/dependency-upgrade-review/evals/files/5/.github/workflows/ci.yml

@@ -0,0 +1,22 @@
+name: ci
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@9ce6fd9fa4b164bf8911b62115bf9104ba1a2803 # v4.2.0
+      - uses: bramblewick/setup-toolchain@c8aee2ae521bdb1ef1b97761673ebbe92c953b0f # v3.2.0
+        with:
+          node-version-file: .nvmrc
+      - run: npm ci --ignore-scripts
+      - run: npm run lint
+      - run: npm test
+      - run: npm run build

package/packs/dev-team/skills/dependency-upgrade-review/evals/files/5/.github/workflows/release.yml

@@ -0,0 +1,25 @@
+name: release
+
+on:
+  push:
+    tags: ["v*"]
+
+permissions:
+  contents: write
+  id-token: write
+
+jobs:
+  publish:
+    runs-on: [self-hosted, linux, release]
+    environment: production
+    steps:
+      - uses: actions/checkout@9ce6fd9fa4b164bf8911b62115bf9104ba1a2803 # v4.2.0
+      - uses: bramblewick/setup-toolchain@c8aee2ae521bdb1ef1b97761673ebbe92c953b0f # v3.2.0
+        with:
+          node-version-file: .nvmrc
+      - run: npm ci
+      - run: npm run build
+      - run: npm run release
+        env:
+          RELEASE_SIGNING_KEY: ${{ secrets.RELEASE_SIGNING_KEY }}
+          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}

package/packs/dev-team/skills/dependency-upgrade-review/evals/files/5/.nvmrc

@@ -0,0 +1 @@
+22.11.0

package/packs/dev-team/skills/dependency-upgrade-review/evals/files/5/PR-412.md

@@ -0,0 +1,16 @@
+# PR #412: Bump bramblewick/setup-toolchain from 3.2.0 to 3.3.0
+
+**Author:** dependabot[bot]
+**Base:** main  **Head:** dependabot/github_actions/bramblewick/setup-toolchain-3.3.0
+**Checks:** ✅ ci / test (pull_request) — passed
+
+Bumps [bramblewick/setup-toolchain](https://github.com/bramblewick/setup-toolchain) from 3.2.0 to 3.3.0.
+
+Release notes: see `upstream/setup-toolchain-RELEASES.md`.
+
+**Commits on this branch**
+1. `dependabot[bot]` — Bump bramblewick/setup-toolchain from 3.2.0 to 3.3.0
+2. `mkowalczyk` — "dependabot only touched ci.yml, bumped release.yml too so they match"
+
+---
+Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself.

package/packs/dev-team/skills/dependency-upgrade-review/evals/files/5/PR-413.md

@@ -0,0 +1,15 @@
+# PR #413: Bump release-notary from 1.8.2 to 1.9.0
+
+**Author:** dependabot[bot]
+**Base:** main  **Head:** dependabot/npm_and_yarn/release-notary-1.9.0
+**Labels:** dependencies, javascript
+**Checks:** ✅ ci / test (pull_request) — passed
+
+Bumps [release-notary](https://github.com/notary-tools/release-notary) from 1.8.2 to 1.9.0.
+
+Changelog: see `upstream/release-notary-CHANGELOG.md`.
+
+[![Dependabot compatibility score](https://example.invalid/badge)](#) — compatibility score unknown (too few updates).
+
+---
+Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself.

package/packs/dev-team/skills/dependency-upgrade-review/evals/files/5/package.json

@@ -0,0 +1,21 @@
+{
+  "name": "@harrowfield/ledger-ui",
+  "version": "5.12.0",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "lint": "eslint-mini src",
+    "test": "vitest-lite run",
+    "build": "rollup-lite -c",
+    "release": "node scripts/release.mjs"
+  },
+  "dependencies": {
+    "tally-format": "^2.3.0"
+  },
+  "devDependencies": {
+    "eslint-mini": "^9.1.0",
+    "release-notary": "^1.8.2",
+    "rollup-lite": "^4.0.3",
+    "vitest-lite": "^2.0.0"
+  }
+}

package/packs/dev-team/skills/dependency-upgrade-review/evals/files/5/pr-412.diff

@@ -0,0 +1,26 @@
+diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
+index 3c1d0a2..5e7b9f4 100644
+--- a/.github/workflows/ci.yml
++++ b/.github/workflows/ci.yml
+@@ -13,7 +13,7 @@ jobs:
+     runs-on: ubuntu-latest
+     steps:
+       - uses: actions/checkout@9ce6fd9fa4b164bf8911b62115bf9104ba1a2803 # v4.2.0
+-      - uses: bramblewick/setup-toolchain@c8aee2ae521bdb1ef1b97761673ebbe92c953b0f # v3.2.0
++      - uses: bramblewick/setup-toolchain@8141d107d0837efc25f86e096a7eefd58e979515 # v3.3.0
+         with:
+           node-version-file: .nvmrc
+       - run: npm ci --ignore-scripts
+diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
+index 0a4e8c1..b19d2e7 100644
+--- a/.github/workflows/release.yml
++++ b/.github/workflows/release.yml
+@@ -15,7 +15,7 @@ jobs:
+     environment: production
+     steps:
+       - uses: actions/checkout@9ce6fd9fa4b164bf8911b62115bf9104ba1a2803 # v4.2.0
+-      - uses: bramblewick/setup-toolchain@c8aee2ae521bdb1ef1b97761673ebbe92c953b0f # v3.2.0
++      - uses: bramblewick/setup-toolchain@7dd0aa52537f8f4f4002b505507186cdaec669c4 # v3.3.0
+         with:
+           node-version-file: .nvmrc
+       - run: npm ci

package/packs/dev-team/skills/dependency-upgrade-review/evals/files/5/pr-413.diff

@@ -0,0 +1,84 @@
+diff --git a/package.json b/package.json
+index 61b0e2a..e3f7c19 100644
+--- a/package.json
++++ b/package.json
+@@ -14,7 +14,7 @@
+   },
+   "devDependencies": {
+     "eslint-mini": "^9.1.0",
+-    "release-notary": "^1.8.2",
++    "release-notary": "^1.9.0",
+     "rollup-lite": "^4.0.3",
+     "vitest-lite": "^2.0.0"
+   }
+diff --git a/package-lock.json b/package-lock.json
+index 9f2d4b7..1ac80e5 100644
+--- a/package-lock.json
++++ b/package-lock.json
+@@ -12,7 +12,7 @@
+       "devDependencies": {
+         "eslint-mini": "^9.1.0",
+-        "release-notary": "^1.8.2",
++        "release-notary": "^1.9.0",
+         "rollup-lite": "^4.0.3",
+         "vitest-lite": "^2.0.0"
+       }
+@@ -88,16 +88,6 @@
+-    "node_modules/ansi-tint": {
+-      "version": "1.0.4",
+-      "resolved": "https://registry.npmjs.org/ansi-tint/-/ansi-tint-1.0.4.tgz",
+-      "integrity": "sha512-G/ihecLGe8wYlmaKXMJUFfgBUV/HgkesmrXhTTxBqhQrYzGlVOniQfCu4MlJAUfeyjvVf+TYrCCSemjHEdDQjA==",
+-      "dev": true,
+-      "license": "MIT",
+-      "engines": {
+-        "node": ">=14"
+-      }
+-    },
+@@ -402,30 +392,45 @@
++    "node_modules/notary-telemetry": {
++      "version": "0.2.1",
++      "resolved": "https://npm.notary-cdn.io/notary-telemetry/-/notary-telemetry-0.2.1.tgz",
++      "integrity": "sha512-kJAfi+YYicLisVOtWlYrspxPF4uz6y3b6QfD9GN44+ykAjLtZFIBMPzpRjsixIrGncIVsO5cZPGTL3edJLEDag==",
++      "dev": true,
++      "hasInstallScript": true,
++      "license": "SEE LICENSE IN LICENSE.txt",
++      "dependencies": {
++        "semver-lite": "^2.3.0"
++      }
++    },
+     "node_modules/release-notary": {
+-      "version": "1.8.2",
+-      "resolved": "https://registry.npmjs.org/release-notary/-/release-notary-1.8.2.tgz",
+-      "integrity": "sha512-fS99/rtXzwQTzMu2D7jDqVze+VZpAS8ftGR6+1J6GeJ4JMhkxkVVRhHLpzVp6hV0ijP3EophissfTP0Hmkwt1w==",
++      "version": "1.9.0",
++      "resolved": "https://registry.npmjs.org/release-notary/-/release-notary-1.9.0.tgz",
++      "integrity": "sha512-tQijziAJ067sx63E+cIXmDsbRdzLEMQHqy0fgw7fIyhUwgdc5a8fuiPWzqjJYAobtCht6aI/joOp+Up2ehJRJw==",
+       "dev": true,
+       "license": "MIT",
+       "dependencies": {
+-        "ansi-tint": "^1.0.4",
+-        "semver-lite": "^2.1.0"
++        "notary-telemetry": "^0.2.0",
++        "semver-lite": "^2.3.0"
+       },
+       "bin": {
+         "release-notary": "bin/cli.js"
+       },
+       "engines": {
+-        "node": ">=18"
++        "node": ">=20"
+       }
+     },
+     "node_modules/semver-lite": {
+-      "version": "2.1.0",
+-      "resolved": "https://registry.npmjs.org/semver-lite/-/semver-lite-2.1.0.tgz",
+-      "integrity": "sha512-OvGVOs6Tl8EYX9VxOQgB0MNBqP8uY+ct5KATLIi3BGLPF+9vAb31PrWFxtbLBcjZh4H9oT1HyzGrx+ItXrSJNw==",
++      "version": "2.3.0",
++      "resolved": "https://registry.npmjs.org/semver-lite/-/semver-lite-2.3.0.tgz",
++      "integrity": "sha512-nqjU6Z/9qqziJrOHoLWWbE+gjkE23/xqf9pqZOkyicwfti0SgB9uhlk/QMZGMbmYzsnc3cKwq6VD/3JmK2JnHA==",
+       "dev": true,
+       "license": "ISC",
+       "engines": {
+         "node": ">=16"
+       }
+     },

package/packs/dev-team/skills/dependency-upgrade-review/evals/files/5/scripts/release.mjs

@@ -0,0 +1,18 @@
+// Publishes the built bundle and a signed provenance manifest.
+// Run only from .github/workflows/release.yml on a version tag.
+import { createNotary } from "release-notary";
+import pkg from "../package.json" with { type: "json" };
+
+const notary = createNotary({
+  // legacyMode keeps the v1 manifest layout that the downstream
+  // ledger-portal deploy script still parses.
+  legacyMode: true,
+  signingKey: process.env.RELEASE_SIGNING_KEY,
+});
+
+await notary.publish({
+  name: pkg.name,
+  version: pkg.version,
+  dir: "dist",
+  sign: true,
+});

package/packs/dev-team/skills/dependency-upgrade-review/evals/files/5/upstream/release-notary-CHANGELOG.md

@@ -0,0 +1,16 @@
+# release-notary changelog
+
+## 1.9.0 — 2026-10-02
+
+- **Removed** the `legacyMode` option of `createNotary()`, deprecated since 1.6.0. Passing it now throws `TypeError: Unknown option "legacyMode"`. Manifests are always written in the v2 layout (`manifest.files[]` replaces the top-level `artifacts` map).
+- Added opt-out usage reporting through the new `notary-telemetry` dependency. It runs at install time to detect the CI provider and sends an anonymous ping when `publish()` runs. Disable with `NOTARY_TELEMETRY=0`.
+- Requires Node.js 20 or newer.
+- Dropped `ansi-tint`; output colouring uses `util.styleText`.
+
+## 1.8.3 — 2026-08-20
+
+- Fixed: `publish({ sign: true })` silently skipped signing when `signingKey` was an empty string. It now throws `Error: signingKey is empty`.
+
+## 1.8.2 — 2026-07-01
+
+- Fixed Windows path separators in manifest entries.

package/packs/dev-team/skills/dependency-upgrade-review/evals/files/5/upstream/setup-toolchain-RELEASES.md

@@ -0,0 +1,22 @@
+# bramblewick/setup-toolchain releases
+
+## v3.3.0 (2026-10-06)
+
+### Breaking-ish
+- The action now runs on the `node24` runtime (was `node20`). GitHub-hosted runners already support it. **Self-hosted runners must be on actions/runner v2.328.0 or newer**, otherwise the job fails with `Parameter 'using: node24' is not supported`.
+
+### Changed
+- `cache` now defaults to `true` (was `false`). The npm cache is keyed on the lockfile hash and restored automatically. Set `cache: false` to keep the old behaviour.
+
+### Added
+- `node-version-file` accepts `package.json#engines.node`.
+
+## v3.2.1 (2026-09-12)
+
+### Security
+- Fixed a cache-key collision (GHSA-xxxx-fict-0001) in which a workflow run triggered by a pull request from a fork could write a cache entry that a later run on the default branch restored. Only affected users who set `cache: true`.
+
+## v3.2.0 (2026-07-30)
+
+### Added
+- Support for `.tool-versions`.

package/packs/dev-team/skills/dependency-upgrade-review/examples/inputs/ledgerline.diff

@@ -0,0 +1,38 @@
+diff --git a/poetry.lock b/poetry.lock
+index f6ddbc1..3b139f9 100644
+--- a/poetry.lock
++++ b/poetry.lock
+@@ -2,7 +2,7 @@
+ 
+ [[package]]
+ name = "charset-sniff"
+-version = "1.4.0"
++version = "1.4.1"
+ description = "Guess the text encoding of a byte string"
+ optional = false
+ python-versions = ">=3.9"
+@@ -10,7 +10,7 @@ files = []
+ 
+ [[package]]
+ name = "tidyparse"
+-version = "2.2.0"
++version = "2.2.2"
+ description = "Forgiving CSV and TSV parser"
+ optional = false
+ python-versions = ">=3.9"
+@@ -22,4 +22,4 @@ charset-sniff = ">=1.4,<2"
+ [metadata]
+ lock-version = "2.0"
+ python-versions = "^3.11"
+-content-hash = "0000000000000000000000000000000000000000000000000000000000000001"
++content-hash = "0000000000000000000000000000000000000000000000000000000000000002"
+diff --git a/pyproject.toml b/pyproject.toml
+index 12e2f0a..9848a83 100644
+--- a/pyproject.toml
++++ b/pyproject.toml
+@@ -6,4 +6,4 @@ authors = ["Ledgerline maintainers"]
+ 
+ [tool.poetry.dependencies]
+ python = "^3.11"
+-tidyparse = "^2.2.0"
++tidyparse = "^2.2.2"

package/packs/dev-team/skills/dependency-upgrade-review/examples/ledgerline-tidyparse.md

@@ -0,0 +1,91 @@
+# Worked example: Ledgerline, a Poetry patch bump that earns MERGE
+
+Most worked examples end in a block. This one shows what it takes to close every check, so MERGE is earned rather than assumed.
+
+## Input
+
+The user says: *"Can I merge PR #57 on ledgerline, 'chore(deps): bump tidyparse to 2.2.2'? CI is green."* and supplies:
+
+- the diff, [`inputs/ledgerline.diff`](inputs/ledgerline.diff) (`pyproject.toml` and `poetry.lock`)
+- tidyparse's changelog for 2.2.1 and 2.2.2
+- the repo: `app/ingest.py`, `tests/test_ingest.py`, `.github/workflows/ci.yml`
+
+Changelog excerpt as supplied:
+
+```markdown
+## 2.2.2
+- Security: a single line longer than 10 MB is now rejected with RowTooLongError
+  (a subclass of ParseError) instead of being read into memory.
+
+## 2.2.1
+- Fixed: a quoted field containing a newline was split into two rows.
+```
+
+Repo excerpts as supplied:
+
+```python
+# app/ingest.py
+12  def import_statement(path):
+13      try:
+14          rows = tidyparse.parse_rows(path, dialect="excel")
+15      except tidyparse.ParseError as exc:
+16          raise StatementRejected(str(exc)) from exc
+```
+
+```python
+# tests/test_ingest.py
+ 3  from app.ingest import import_statement
+ 9  def test_quoted_newline_stays_one_row(tmp_path): ...
+17  def test_malformed_file_is_rejected(tmp_path): ...
+```
+
+`.github/workflows/ci.yml` runs `pytest -q` on `pull_request`.
+
+## Script output (real; the header, the fixed footer and the empty sections trimmed)
+
+```bash
+python3 scripts/upgrade_diff.py examples/inputs/ledgerline.diff --title "chore(deps): bump tidyparse to 2.2.2"
+```
+
+```markdown
+**Floor verdict: none from the diff** (mechanical; the changelog, usage and CI checks are still to do, and only they can make it MERGE)
+
+## Changed (3)
+
+| Package | Ecosystem | Old → New | Class | File | Notes |
+|---|---|---|---|---|---|
+| `charset-sniff` | pip | 1.4.0 → 1.4.1 | patch | `poetry.lock` | lockfile only (transitive); not named in the title |
+| `tidyparse` | pip | 2.2.0 → 2.2.2 | patch | `poetry.lock` | direct |
+| `tidyparse` | pip | ^2.2.0 → ^2.2.2 | patch | `pyproject.toml` |  |
+
+## Beyond the title (1)
+
+- `charset-sniff` changed: 1.4.0 → 1.4.1 (poetry.lock)
+```
+
+No install scripts, sources, licences or pins appear. The floor says only that the diff itself raises nothing; the notes, the search and CI decide the rest.
+
+## Review (what the agent hands back)
+
+**MERGE.** A two-release patch bump whose only behaviour change, the new 10 MB line limit in 2.2.2, raises an error the import code already handles, and CI runs that code.
+
+🟨 Notes
+
+- Both releases read. 2.2.1 fixes quoted newlines splitting rows, which `test_quoted_newline_stays_one_row` (`tests/test_ingest.py:9`) covers. 2.2.2 is a security fix: lines over 10 MB now raise `RowTooLongError`, a subclass of `ParseError`.
+- Search: `git grep -n "tidyparse" -- '*.py'` finds one call, `app/ingest.py:14`, inside `except tidyparse.ParseError` (`app/ingest.py:15`). The new error is caught there and becomes `StatementRejected`, the same path as any malformed file.
+- CI: `ci.yml` runs `pytest -q` on the PR, and `tests/test_ingest.py:3` imports `import_statement`, so the changed code ran. No test feeds a 10 MB line; that is the library's limit, not a change in this repo's behaviour.
+- Beyond the title: `charset-sniff` 1.4.0 → 1.4.1, a transitive patch, listed and not read.
+- No new packages, install scripts, registry changes or pins.
+
+| Package | Old → New | Class | Direct? |
+|---|---|---|---|
+| tidyparse | 2.2.0 → 2.2.2 | patch | direct |
+| charset-sniff | 1.4.0 → 1.4.1 | patch | transitive |
+
+Rollback: `git revert` the merge commit, or `poetry add tidyparse@2.2.0` and commit `pyproject.toml` and `poetry.lock`. Nothing persists to undo, but rolling back reopens the 2.2.2 memory issue, so pin back to 2.2.0 only as a stopgap.
+
+To confirm: nothing.
+
+## Why this is MERGE and not MERGE AFTER CHECKS
+
+Every check in the verdict rule is closed with evidence in the reply: both releases read, the one changed behaviour searched and found handled, the calling code run by a PR test, no pins, no install-time code, no new source. Remove any one of those (no repo to search, a release with no notes, a test that does not import `app/ingest.py`) and the verdict drops to MERGE AFTER CHECKS with that item as the check.

package/packs/dev-team/skills/dependency-upgrade-review/manifest.json

@@ -0,0 +1,50 @@
+{
+  "name": "dependency-upgrade-review",
+  "version": "0.1.0",
+  "description": "Give a merge verdict on a dependency-upgrade pull request (Dependabot, Renovate or a hand-made bump) across npm, pip, Go, Cargo and Maven lockfiles and GitHub Actions pins. Reads the release notes for every skipped version, lists what the lockfile changes beyond the PR title (transitive bumps, new and removed packages, install scripts, registry changes), checks that each SHA pin is the commit its release tag points to, says whether CI ran the changed code, finds the repo's uses of changed APIs and writes the rollback, ending in MERGE, MERGE AFTER CHECKS or DO NOT MERGE. Use when the user says \"review this Dependabot PR\", \"is this Renovate bump safe to merge\", \"can I merge this dependency upgrade\", \"check this lockfile diff\", or \"is this action SHA pin right\".",
+  "entrypoint": "SKILL.md",
+  "deps": {
+    "npm": [],
+    "pip": []
+  },
+  "env": {
+    "required": [],
+    "optional": []
+  },
+  "related": [
+    "migration-plan",
+    "pre-merge-review",
+    "release-notes"
+  ],
+  "handoff": [
+    {
+      "to": "migration-plan",
+      "when": "the upgrade is a major framework or runtime jump that cannot land as one PR",
+      "purpose": "Plan the staged migration, the compatibility shims and the cutover instead of forcing the bump through.",
+      "fallback": "If migration-plan is absent, list the breaking changes the repo hits, the order to fix them in, and the rollback point for each step inline, and keep the verdict at DO NOT MERGE."
+    },
+    {
+      "to": "pre-merge-review",
+      "when": "the PR also carries hand-written code changes beyond manifests, lockfiles and pins",
+      "purpose": "Review the code change itself with the full correctness, security and quality pass.",
+      "fallback": "If pre-merge-review is absent, review the non-dependency files inline for correctness and tests, and say that part of the review was done without the full panel."
+    }
+  ],
+  "tags": [
+    "dependencies",
+    "supply-chain",
+    "code-review",
+    "dependabot",
+    "github-actions"
+  ],
+  "permissions": {
+    "network": [],
+    "commands": [],
+    "files": "named-paths",
+    "notes": "Reads only the diff path it is given, or stdin; writes only the -o path when given. No network: SHA verification and changelog reading are printed as commands for the reviewer to run."
+  },
+  "model": {
+    "tier": "standard",
+    "rationale": "Reads a version diff, changelogs and CI evidence against a fixed checklist; the merge verdict follows from what is verified, not open-ended judgment."
+  }
+}