dep-patch-bump

Bump a dependency within its major version. Category: dependencies. Scope: small.

omot bench start dep-patch-bump --param package=zod --agent <your-agent>

ParametersCopy Anchor Link

PreconditionsCopy Anchor Link

• The package is declared in dependencies, devDependencies, or optionalDependencies of a package.json.
• A committed lockfile (pnpm, npm, yarn, or bun).
• Dependencies are installed locally so build and test scripts can run.

OutcomesCopy Anchor Link

• pass: The lockfile changed for the package, its major version (minor for 0.x) is unchanged, no other dependency changed, and the build and test scripts pass.
• partial: The package was updated within its major version, but the bumped version is not installed, the build or tests fail, or other dependencies changed.
• fail: The lockfile was not updated for the package, the package was removed, or its major version changed.

How it is verifiedCopy Anchor Link

• Reads every package.json that declares the package at start, and records the declared ranges.
• Lockfile: for package-lock.json/npm-shrinkwrap.json, compares the package's node_modules/<package> entries; for pnpm, yarn, and bun text lockfiles, an added diff line must mention the package; a changed bun.lockb counts.
• Major version: compares the first number of the declared range before and after (for 0.x, the first two numbers), so ^1.1.0 → ^1.3.0 is fine and ^1.1.0 → ^2.0.0 fails.
• Installed version: for each package.json that declares the package, resolves node_modules/<package>/package.json the way Node does, walking from the declaring directory up to the repository root (following pnpm symlinks into the virtual store), and compares it with the version the lockfile resolves for that package (the pnpm importer's resolved version, the yarn entry for its declared range, the bun package entry for that workspace, or the npm entry Node would resolve), falling back to the versions the lockfile change added, and using the lockfile nearest to that package (npm-shrinkwrap.json takes precedence over package-lock.json in the same directory; otherwise a changed one is preferred within a directory); a declaring package whose spec changed but whose own lockfile was not updated makes the result partial, as does a bumped range the lockfile still records differently (or not at all). No install is run. Yarn Plug'n'Play installs and bun.lockb are skipped. A missing or stale install makes the result partial, and the build and test scripts still run.
• Runs the build and test scripts with the detected package manager and records their baseline exit codes at start (missing scripts are skipped and reported).
• A script failure that also occurred at baseline is not counted against the agent and includes the output tail. If baseline scripts were skipped or that script did not exist at start, a later failure is counted and reported with unknown baseline health.

The prompt and verifier live in packages/benchmarks/src/tasks/dep-patch-bump. Changing either requires a version bump in task.json.