Upgrade one dependency or framework with a compatibility matrix, lockfile diff, and transitive scan. Review new permissions, postinstall scripts, bundle changes, license, and vulnerability status.

Objective

upgrade one package or framework.

Context

lockfile, changelog, advisories, compatibility matrix.

Decompose

inspect release notes, update lockfile, fix code, run tests, scan transitive dependencies.

Criteria

build, unit/integration/e2e checks, license and vulnerability policy.

Review/security

verify new permissions, postinstall scripts, and bundle changes.

Rollback

retain lockfile diff and previous artifact.

Output

upgrade rationale, breaking changes, scanner result.

Handoff checklist

  • Release notes and breaking changes
  • Lockfile is pinned
  • Tests and build pass
  • SBOM and license scan complete
Editorial recipe adapted from the project’s September 2026 research brief. Commands, authority and acceptance tests must be matched to your repository. No production execution is implied.

Use the bounded agent contract before starting ↗