ui5-version-upgrade — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited ui5-version-upgrade (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A migration workflow for SAPUI5/OpenUI5 projects. Use two MCP servers together:
ui5_version_diff, backed by a local ui5-lib-diff all-changes JSON bundle. It answers "what changed between versions?" and includes SAPUI5 What's New entries for the same range.Do not scrape the ui5-lib-diff browser route for JSON. The browser URL with versionFrom, versionTo, and ui5Type is client-rendered. Use ui5_version_diff; it reads the local all-changes.json bundle and returns all matching structured entries. npm run setup refreshes the bundle automatically; if it is missing or stale, refresh it during setup/rebuild with npm run download:ui5-lib-diff or point UI5_LIB_DIFF_BUNDLE_PATH to a local copy. The runtime is local-only and must not rely on external requests.
Current SAP @ui5/mcp-server capabilities include:
get_project_info: read project metadata and UI5 configuration.get_version_info: retrieve UI5 framework version information.get_guidelines: fetch UI5 coding standards and best practices.get_api_reference: fetch UI5 API documentation for controls/classes/methods.run_ui5_linter: run @ui5/linter against the app.run_manifest_validation: validate webapp/manifest.json.get_typescript_conversion_guidelines: guidance for JavaScript-to-TypeScript UI5 work.create_ui5_app, create_integration_card, get_integration_cards_guidelines: scaffolding/card-specific work. Use only when the user asks for creation or card work.Determine these before producing recommendations:
from_version): prefer get_project_info / get_version_info; otherwise read webapp/manifest.json, ui5.yaml, and package.json.to_version): ask if absent. Use the full x.y.z form.SAPUI5 if the app depends on commercial libraries such as sap.ui.comp, sap.suite.*, sap.fe, sap.ui.mdc, or FLP/ushell; otherwise use OpenUI5.sap.ui5.dependencies.libs and use them to focus feature/fix review.Call:
ui5_version_diff(library, from_version, to_version)Summarize versionsInRange, counts, totalEntries, whatsNewTotalEntries, and any meta.notes. Keep meta.sourceDataPath and meta.generatedAt for traceability and stale-bundle checks. If the user asks about one release, call ui5_version_diff(library, version=<x.y.z>).
Call:
get_project_info(projectPath=<project root>)
get_version_info(projectPath=<project root>)
get_guidelines()Use get_guidelines once per workflow to anchor coding recommendations. Do not repeatedly fetch broad guidelines inside loops.
Call:
ui5_version_diff(library, from_version, to_version, types=["DEPRECATED"])
run_ui5_linter(projectPath=<project root>)Cross-reference diff deprecations with linter findings and code search. Report only confirmed or strongly suspected usage in the app. Skip deprecations that do not match the project.
For confirmed APIs, call:
get_api_reference(name=<control/class/method>)Use this for replacement details. Do not invent replacements from memory.
Search project comments and code for TODO, FIXME, workaround, BCP/ticket IDs, and symptom words. For each meaningful symptom:
ui5_version_diff(library, from_version, to_version, types=["FIX"], query=<symptom>)If there is a matching fix, cite the entry and commit URL, then verify whether the local workaround can be removed safely.
For each declared UI5 library:
ui5_version_diff(library, from_version, to_version, types=["FEATURE"], ui5_library=<declared lib>)Keep this selective. Mention features that plausibly affect the app's libraries or current code, not every framework feature.
Call:
run_manifest_validation(manifestPath=<project root>/webapp/manifest.json)
run_ui5_linter(projectPath=<project root>)After making fixes, rerun the linter and manifest validation. Treat these tool results as stronger evidence than general release-note text.
Default to one concise Markdown report:
Keep raw diff output out of the report. The tool returns all matching entries; if the result is broad, make narrower follow-up calls with types, ui5_library, or query.
x.y.z versions. If a requested patch is unavailable, ui5_version_diff resolves it to the nearest lower available patch with the same major.minor, matching the ui5-lib-diff web app.(from_version, to_version]. For one release, use version=<x.y.z> or pass only one version field.meta.notes says the requested release is newer than the local bundle, do not attempt runtime web fetches. Tell the user the setup-time bundle is stale and should be refreshed before relying on that release.create_ui5_app, create_integration_card) unless the user requested creation.@ui5/mcp-server is unavailable, proceed with degraded coverage: use ui5_version_diff, local file inspection, and rg across webapp/**/*.{js,ts,xml,json}. Tell the user which UI5 MCP checks were skipped.ui5_version_diff reports that the local bundle is missing or stale, refresh the bundle during setup/rebuild with npm run download:ui5-lib-diff in the MCP server repo or point UI5_LIB_DIFF_BUNDLE_PATH to a local copy.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.