| name | vendor-update |
| description | Upgrade Go/Node.js vendor dependencies and sync tool versions. Use whenever the user says "upgrade dependencies", "update vendors", "vendor update", "run vendor-upgrade", "bump dependencies", "update packages", or asks to run the `vendor-update` Make target. This skill also checks `scripts/build/version.mk` after upgrading to see if any tracked tool versions need updating too, and removes stale binaries from `bin/` when versions change.
|
| compatibility | go, make |
Upgrade vendor dependencies
Run the vendor-update Make target across all projects:
make vendor-update
This runs go get -u ./... and go mod tidy -compat=1.25 in each project directory (ui, banyand, bydbctl, mcp, fodc/agent, fodc/proxy, pkg, test).
Update license dependencies
After the vendor upgrade completes, run make license-dep to update any license-related files that may have changed due to new or updated dependencies:
make license-dep
This ensures license headers and dependency license files stay in sync with the upgraded vendors.
Check for tool version drift
After upgrading, compare go.mod dependency versions against scripts/build/version.mk to find any tools whose library version was bumped and may need their tool version updated.
Version mapping
Read scripts/build/version.mk and go.mod in parallel. For each tool version variable, check if the corresponding library in go.mod was upgraded:
| version.mk variable | Binary | go.mod package |
|---|
BUF_VERSION | bin/buf | github.com/bufbuild/buf (if present) |
PROTOC_GEN_GO_VERSION | bin/protoc-gen-go | google.golang.org/protobuf |
PROTOC_GEN_GO_GRPC_VERSION | bin/protoc-gen-go-grpc | google.golang.org/grpc |
PROTOC_GEN_DOC_VERSION | bin/protoc-gen-doc | github.com/pseudomuto/protoc-gen-doc (if present) |
GRPC_GATEWAY_VERSION | bin/protoc-gen-grpc-gateway | github.com/grpc-ecosystem/grpc-gateway/v2 |
PROTOC_GEN_VALIDATE_VERSION | bin/protoc-gen-validate | github.com/envoyproxy/protoc-gen-validate |
GOLANGCI_LINT_VERSION | bin/golangci-lint | (no go.mod entry — only in version.mk) |
REVIVE_VERSION | bin/revive | (no go.mod entry — only in version.mk) |
LICENSE_EYE_VERSION | bin/license-eye | (no go.mod entry — only in version.mk) |
MOCKGEN_VERSION | bin/mockgen | go.uber.org/mock |
GINKGO_VERSION | bin/ginkgo | github.com/onsi/ginkgo/v2 |
GOVULNCHECK_VERSION | bin/govulncheck | golang.org/x/vuln |
BPF2GO_VERSION | (used in bpf2go.mk) | github.com/cilium/ebpf |
Only update version.mk if the library version in go.mod has changed and the tool version should follow. Many tools (golangci-lint, revive, license-eye) are not in go.mod — their versions only change when explicitly updated in version.mk, not from make vendor-update.
Update version.mk if needed
If a tool version should be bumped (library changed and tool version needs to match), update scripts/build/version.mk using the Edit tool. Keep the format exactly — e.g., PROTOC_GEN_GO_VERSION := v1.36.11.
Remove stale binaries
When version.mk is updated, remove the corresponding old binary from bin/:
rm bin/<binary-name>
This ensures the next build/install of that tool fetches the correct new version.
