update-deps

name	update-deps
description	Safely update project dependencies with testing verification
user-invocable	true

/update-deps - Dependency Updates

Safely update project dependencies.

Usage

/update-deps                 # Check and update all dependencies
/update-deps --minor         # Only minor/patch updates
/update-deps --security      # Security updates only

Process

1. Check Current Status

# Node.js
npm outdated
# or
pnpm outdated

# Python
pip list --outdated
# or with uv
uv pip list --outdated

# Rust
cargo outdated

# Go
go list -m -u all

2. Check for Security Issues

# Node.js
npm audit
pnpm audit

# Python
pip-audit
safety check

# Rust
cargo audit

# Go
govulncheck ./...

3. Categorize Updates

Category	Risk Level	Action
Security patches	Critical	Update immediately
Patch versions (x.x.X)	Low	Usually safe
Minor versions (x.X.0)	Medium	Review changelog
Major versions (X.0.0)	High	Check breaking changes

4. Update Strategy

Safe Updates First

# Node.js - patch updates only
npm update

# Or specific packages
npm update lodash express

# Python
pip install --upgrade package==x.x.x

Minor Updates

# Node.js - use npm-check-updates
npx npm-check-updates -u --target minor
npm install

# Python - update to latest minor
pip install 'package>=1.0,<2.0'

Major Updates (Careful!)

# Check breaking changes first
npm info package changelog

# Update one at a time
npm install package@latest

# Run tests after each
npm test

5. Verify Updates

After each update batch:

# Run tests
npm test

# Run type check
npm run typecheck

# Run build
npm run build

# Quick smoke test
npm run dev

Update Report Template

## Dependency Update Report

**Date**: [Date]
**Updated By**: [Name]

### Security Updates (Critical)
| Package | From | To | CVE |
|---------|------|-----|-----|
| lodash | 4.17.19 | 4.17.21 | CVE-2021-23337 |

### Patch Updates (Low Risk)
| Package | From | To |
|---------|------|-----|
| express | 4.18.1 | 4.18.2 |

### Minor Updates (Medium Risk)
| Package | From | To | Notes |
|---------|------|-----|-------|
| react | 18.2.0 | 18.3.0 | New hooks |

### Major Updates (Review Required)
| Package | From | To | Breaking Changes |
|---------|------|-----|------------------|
| typescript | 4.9.5 | 5.3.0 | See migration guide |

### Skipped Updates
| Package | Current | Latest | Reason |
|---------|---------|--------|--------|
| webpack | 4.46.0 | 5.89.0 | Major refactor needed |

### Testing
- [ ] Unit tests pass
- [ ] Integration tests pass
- [ ] Build succeeds
- [ ] Manual smoke test

Handling Breaking Changes

Before Major Update

1. Read the changelog/migration guide
2. Check if project uses affected features
3. Estimate effort to update
4. Create a separate branch

Migration Process

## Migration: [Package] v[Old] → v[New]

### Breaking Changes That Affect Us
1. [Change 1] - Used in: [files]
2. [Change 2] - Used in: [files]

### Migration Steps
- [ ] Update package
- [ ] Fix [breaking change 1]
- [ ] Fix [breaking change 2]
- [ ] Update tests
- [ ] Update documentation

### Files Modified
- src/utils/helper.ts
- src/components/Button.tsx

Lock File Management

Keep lock files in sync:

# Node.js - regenerate lock file
rm -rf node_modules package-lock.json
npm install

# Python - regenerate requirements
pip freeze > requirements.txt

# Or with pip-tools
pip-compile requirements.in

Automated Updates

Consider automation tools:

# Dependabot (.github/dependabot.yml)
version: 2
updates:
  - package-ecosystem: "npm"
    directory: "/"
    schedule:
      interval: "weekly"
    groups:
      development-dependencies:
        dependency-type: "development"
      production-dependencies:
        dependency-type: "production"

Tips

• Update dependencies regularly (weekly/monthly)
• Don't let them get too far behind
• Pin exact versions in production
• Test thoroughly after updates
• Keep a changelog of dependency updates
• Consider using Renovate or Dependabot