bellotreno-dependency-review

name	bellotreno-dependency-review
description	Review and verify BelloTreno dependency updates with release-note, advisory, lockfile, CI, and runtime-risk analysis. Use for Dependabot pull requests, npm or GitHub Actions upgrades, npm audit findings, vulnerable transitive packages, package-manager or Node changes, grouped updates, and proposed Python or Docker dependency automation.

BelloTreno Dependency Review

Treat bot-generated updates as proposed code changes, not trusted automation. Keep compatible maintenance separate from major migrations.

Establish Scope

1. Inspect package.json, package-lock.json, .node-version, the affected workflow, and .github/dependabot.yml.
2. Identify current, requested, compatible, and latest versions. Use npm outdated --json for npm and read primary release notes or advisories for material changes.
3. Classify every update as patch, minor, major, date-versioned, GitHub Action, transitive security resolution, or toolchain migration.
4. For grouped PRs, assess each direct dependency and the combined lockfile blast radius. Split a risky or unrelated major from routine maintenance.

Evaluate Risk

• Check Astro, Tailwind, DaisyUI, TypeScript, Node types, and Cloudflare types as a compatible toolchain rather than isolated packages.
• Treat Astro or Vite changes as build and development-server changes even when the deployed site is static.
• For GitHub Actions, review permissions, input changes, runner/runtime changes, cache behavior, and whether the pinned major is still supported.
• Map an advisory to the affected dependency path and repository usage. Record whether it is runtime, build-time, development-only, Windows-specific, or unreachable; do not dismiss severity without that evidence.
• Preserve packageManager, engines, and .node-version unless the toolchain update is explicitly in scope.