| name | jwr-dep-update |
| description | Updates project dependencies for npm and Go ecosystems, runs audits and tests, and reports issues for manual review. Use when the user asks to update dependencies, bump packages, run npm-check-updates, refresh go.mod, or perform routine dependency maintenance. Never commits or pushes. |
| disable-model-invocation | true |
jwr-dep-update
Update dependencies, validate the result, and produce a review report. Do not commit, push, or stage changes. Leave all modified lockfiles and manifests for the user to review.
Hard rules
- Never run
git add, git commit, git push, or any skill that commits (e.g. jwr-gacp).
- Never use
npm audit fix --force unless the user explicitly approves after seeing the report.
- Stop and ask before making source-code changes to fix breakage (only dependency/lockfile updates are in scope by default).
- Summarize every warning, failure, and unresolved audit finding in the final report.
Workflow overview
Task Progress:
- [ ] 1. Discover ecosystems and baseline state
- [ ] 2. Update dependencies (npm and/or Go)
- [ ] 3. Audit and tidy
- [ ] 4. Build and test
- [ ] 5. Report for manual review
Step 1: Discover ecosystems
From the repo root (or path the user gave):
- Find
package.json files (npm/JavaScript).
- Find
go.mod files (Go).
- Note a root
Makefile, integration-tests/, and other test entry points (see jwr-soa-2.0 layout when present).
Record current branch and whether the working tree was clean before starting (git status for context only — do not stage).
For monorepos, update each npm or Go module separately; run tests at the appropriate scope (per package or repo-wide make targets).
Step 2: npm updates
When package.json is present, in that directory:
ncu -u
npm install
npm audit fix
If ncu is not on PATH, use npx npm-check-updates -u instead.
After install:
- Read command output for peer dependency warnings, engine mismatches, deprecated packages, and install errors.
- Run
npm audit again if npm audit fix could not resolve everything; list remaining vulnerabilities by severity.
- Note major version bumps in
package.json (breaking-change risk).
Step 3: Go updates
When go.mod is present, in that module directory:
go get -u ./...
go mod tidy
Then scan output for:
- Retracted module versions
- Incompatible or ambiguous module paths
go mod tidy errors or unexpected replace/exclude changes
Step 4: Build and test
Prefer project conventions when they exist:
| Signal | Action |
|---|
Root or subdir Makefile | make, make test, and other relevant targets |
| Go module | go test ./... (add -race if the project normally uses it) |
npm package with "test" script | npm test |
integration-tests/ or jwr-soa-2.0 layout | Run integration tests per project docs or Makefile |
CI config (.github/workflows, etc.) | Mirror lint/test steps locally when feasible |
If tests fail:
- Capture the failure output.
- Attempt minimal fixes only when clearly caused by the dependency bump (e.g. renamed export, trivial API change).
- If the fix needs non-trivial code changes, stop, document the failure, and leave fixes to the user.
Do not skip tests when they exist and are runnable in this environment.
Step 5: Report for manual review
Use this template:
# Dependency update report
## Summary
[One paragraph: what was updated, overall pass/fail]
## Ecosystems touched
- [ ] npm: [paths]
- [ ] Go: [paths]
## Version changes
### npm
| Package | Before | After |
|---------|--------|-------|
### Go
[List notable module version changes from go.mod / go.sum diff]
## Audit / security
- npm audit: [clean / N remaining — list critical/high]
- Other: [go vuln check if run, etc.]
## Tests
| Target | Result | Notes |
|--------|--------|-------|
## Warnings and manual follow-ups
- [ ] Review lockfile changes (`package-lock.json`, `go.sum`)
- [ ] Review major semver bumps
- [ ] [Any unresolved audit items]
- [ ] [Any test failures or suggested code changes]
## Files changed (not committed)
[List key modified files]
Remind the user that changes are uncommitted and require their review before commit.
Prerequisites
- npm: Node.js/npm installed;
npm-check-updates (ncu) available globally or via npx.
- Go: Go toolchain installed; module proxy reachable.
If a prerequisite is missing, report it and stop rather than improvising a partial update.
