dependency-update

name	dependency-update
description	Review, apply, verify, or merge gocron dependency updates from Dependabot or manual requests. Use for Go modules, root/admin/docs pnpm packages, GitHub Actions, Docker base images, security advisories, lockfile conflicts, or dependency update pull requests.

Update gocron dependencies

Handle one dependency group and ecosystem at a time unless a security fix requires coordinated versions. A request to inspect a PR or alert is read-only; merge, dismiss, commit, and push only when explicitly requested.

Assess before changing

• Inspect the manifest and lockfile diff, release notes, advisory, dependency graph, and current CI status. Use primary upstream documentation.
• Classify the update as patch, minor, major, security, development-only, build tooling, GitHub Action, or runtime/container.
• Determine whether the dependency is direct, transitive, bundled into the frontend, shipped in the image, or used only in tests.
• For security alerts, record the vulnerable range, fixed version, severity, reachable code path, and whether every affected workspace is updated.
• Treat major updates, Go/toolchain changes, framework upgrades, database drivers, schedulers, RPC libraries, auth/crypto packages, and container bases as high risk even when the diff is small.

Never edit a lockfile by hand. Use the repository package manager and preserve its existing lockfile format. Do not silence peer dependency failures or add blanket advisory ignores to make a check green.

Apply the smallest update

Use the narrowest ecosystem command that updates the requested package and its required peers. Review the resulting diff for unrelated upgrades, install scripts, new transitive packages, license changes, and unexpected engine or Go version changes. Revert unrelated generated churn without discarding pre-existing user changes.

For a Dependabot PR, prefer checking out or updating its branch rather than reconstructing a different lockfile locally. If the branch is stale, rebase or regenerate only when the user authorized changes to that PR.

Verify by ecosystem

• Go runtime dependency: run go mod tidy, ensure go.mod and go.sum contain only expected changes, then run affected package tests with -race, go vet ./..., and govulncheck ./... when available.
• Admin frontend: run pnpm --dir web/gocronx-admin build-only, pnpm --dir web/gocronx-admin exec vue-tsc --noEmit, and pnpm --dir web/gocronx-admin lint.
• Docs: run pnpm --dir docs docs:build.
• Root tooling: run the affected commit/lint hook command and verify the admin workspace lockfile was not unintentionally changed.
• GitHub Action: validate YAML and inspect the referenced action's changelog and immutable tag/SHA policy.
• Docker/base image: build Dockerfile.gocron and inspect architecture, runtime user, binary/library compatibility, and vulnerability scan results.

Run the relevant package tests even if the dependency is marked dev-only. Invoke $verify before merge for every code or lockfile update.

Decide and report

State the exact old/new versions, why the update is needed, runtime exposure, breaking-change review, manifest/lockfiles changed, audit result, checks run, and remaining risk. Recommend merge only when required checks are green and the diff contains no unexplained dependency churn.

If committing, use one single-line Conventional Commit subject under 100 characters and no Co-Authored-By, for example:

chore(deps): update vue to 3.6.0