Dependency Update Skill

Safe and systematic dependency updates with vulnerability management, license checking, and rollback planning.

When to Use

Update Strategy

Update Types

Semantic Versioning

MAJOR.MINOR.PATCH
  │     │     │
  │     │     └── Bug fixes (backward compatible)
  │     └──────── New features (backward compatible)
  └────────────── Breaking changes

Prerequisites

Before starting:

• All tests passing
• Clean git working directory
• Recent backup/checkpoint
• Time for testing and potential rollback
• Access to changelogs/release notes

Update Process

Phase 1: Audit Dependencies
    ↓
Phase 2: Check Vulnerabilities
    ↓
Phase 3: Check License Compatibility
    ↓
Phase 4: Plan Updates
    ↓
Phase 5: Execute Updates
    ↓
Phase 6: Test & Validate
    ↓
Phase 7: Document & Deploy

Phase 1: Audit Dependencies

List outdated dependencies using ecosystem-specific tools:

# Node.js
npm outdated

# Python
pip list --outdated

# Go
go list -u -m all

# Rust
cargo outdated

# Ruby
bundle outdated

Create update inventory prioritizing direct dependencies over transitive ones.

Phase 2: Check Vulnerabilities

Run security audits:

# Node.js: npm audit
# Python: pip-audit or safety check
# Go: govulncheck ./...
# Rust: cargo audit
# Ruby: bundle audit check

Prioritize by severity: Critical (hours) → High (days) → Moderate (weeks) → Low (monthly).

Phase 3: Check License Compatibility

Check licenses before adding dependencies:

# Node.js: npx license-checker --summary
# Python: pip-licenses

Avoid: GPL-3.0, AGPL-3.0, SSPL, Unlicensed (require legal review). Safe: MIT, Apache-2.0, BSD, ISC.

Phase 4: Plan Updates

Priority: Security → Patches → Minor → Major

Update strategies:

• Individual: Major updates, risky dependencies
• Batched: Patches and minor updates together
• All at once: Only for fresh projects with comprehensive tests

Create update plan grouping by priority and risk level.

Phase 5: Execute Updates

Create branch: git checkout -b chore/dependency-updates-YYYY-MM

Update commands by ecosystem:

# Individual: npm install pkg@ver | pip install pkg==ver | go get pkg@ver
# Batch: npm update | pip install -U pkg1 pkg2 | go get -u ./... | cargo update

Verify lock files updated. Commit with descriptive messages following conventional commits.

Phase 6: Test & Validate

Run comprehensive validation:

# Tests: npm test | pytest | go test ./... | cargo test
# Types: npm run typecheck | mypy . | cargo check
# Lint: npm run lint | ruff check . | golangci-lint run | cargo clippy
# Build: npm run build | go build ./... | cargo build --release

For major updates, verify critical paths manually.

Phase 7: Document & Deploy

Create PR documenting:

• Security fixes with CVE numbers
• Package updates table
• Breaking changes addressed
• Testing checklist completed
• Rollback plan

Deploy: Dev → Staging → Production (with validation at each stage).

Rollback Procedures

If Tests Fail

# Reset to before updates
git checkout package.json package-lock.json
npm install

If Production Issues

# Revert the commit
git revert <update-commit-hash>
npm install
# Deploy revert

Pin Problematic Dependency

// package.json
{
  "dependencies": {
    "problematic-package": "1.2.3"  // Pin to working version
  },
  "resolutions": {
    "problematic-package": "1.2.3"  // Force transitive deps
  }
}

Quick Reference

Commands by Language

Checklist

Pre-Update

• Tests passing
• Clean git state
• Outdated list generated
• Vulnerabilities checked
• Licenses checked
• Update plan created

During Update

• Branch created
• Updates applied
• Lock files updated
• Commits atomic and descriptive

Post-Update

• All tests pass
• Type checks pass
• Lint passes
• Build succeeds
• Manual testing done
• PR created
• Rollback plan ready

Related Workflows

• security-audit.md - Includes vulnerability scanning
• code-review.md - Review updated code
• troubleshooting.md - If updates cause issues

Extended Resources

For detailed per-ecosystem commands, verbose examples, and automation configuration, see:

• references/process.md - Comprehensive ecosystem-specific processes