Upgrade one dependency or framework with a compatibility matrix, lockfile diff, and transitive scan. Review new permissions, postinstall scripts, bundle changes, license, and vulnerability status.
Objective
upgrade one package or framework.
Context
lockfile, changelog, advisories, compatibility matrix.
Decompose
inspect release notes, update lockfile, fix code, run tests, scan transitive dependencies.
Criteria
build, unit/integration/e2e checks, license and vulnerability policy.
Review/security
verify new permissions, postinstall scripts, and bundle changes.
Rollback
retain lockfile diff and previous artifact.
Output
upgrade rationale, breaking changes, scanner result.
Handoff checklist
- Release notes and breaking changes
- Lockfile is pinned
- Tests and build pass
- SBOM and license scan complete
Editorial recipe adapted from the project’s September 2026 research brief. Commands, authority and acceptance tests must be matched to your repository. No production execution is implied.