| name | update-backend-dependencies |
| description | Use when updating npm dependencies, toolchain versions, or container base images in the CommonEx backend project. |
Update Backend Dependencies
Follow .agents/skills/update-dependency-batch for the mandatory four-phase workflow.
Version Sources In Repo
Read versions from:
backend/package.json
backend/package-lock.json
backend/Dockerfile
Use exact versions only. Do not introduce ^ or ~.
Where To Check On The Internet
Use primary sources:
npm outdated for a first pass on installed vs wanted vs latest
npm view <package> version when you need the exact current registry latest
- the package's official changelog, GitHub releases page, or framework release notes
- the base image release page or tag listing for
node:24-alpine3.23
Prefer official NestJS, Fastify, OpenTelemetry, TypeORM, TypeScript, ESLint, Jest, and Node release notes when relevant.
Smallest Valid Update Bundles
Default bundle boundaries:
- Nest stack:
@nestjs/* packages, @nestjs/swagger, @nestjs/terminus, @nestjs/typeorm, and @nestjs/testing when the same upstream release line expects them together
- Fastify stack:
fastify, @fastify/*, and fastify-plugin
- OpenTelemetry stack:
@opentelemetry/* packages and any recursively referenced instrumentation packages
- TypeScript and lint stack:
typescript, @typescript-eslint/*, eslint, @eslint/*, globals, eslint-config-prettier, eslint-plugin-prettier when peer constraints require it
- Test stack:
jest, ts-jest, @types/jest, supertest, and related type packages when peer versions are coupled
- Node image stack:
backend/Dockerfile base image updates
Single-package updates are fine when there is no peer or framework coupling.
Proposal
Follow .agents/skills/update-dependency-batch (one ## N — … section per bundle: Summary, then full numbered release notes). Stop after the proposal; do not edit manifests until the user selects bundles.
Apply (after user selection)
When the user selects bundles in a follow-up message:
- update
package.json, regenerate package-lock.json, and keep pinned exact versions
- refactor deprecated APIs exposed by the chosen upgrades
- update Docker base images when selected and reconcile runtime assumptions if Node or Alpine changed
- ask before making uncertain behavior changes in request handling, persistence, or observability
Validation
Follow project's validation instructions.
If a selected bundle changes migrations, transport behavior, or runtime bootstrap, call that out explicitly in the report.