upgrade-deps

name: upgrade-deps description: Upgrade dependencies and runtimes safely, run CI, and report higher-risk options. argument-hint: [optional scope, e.g. "frontend only" or "include runtimes"]

Run a dependency and runtime upgrade pass for this repository.

User scope or notes: $ARGUMENTS

Follow this workflow exactly:

1. Baseline and inventory

   • Check git status --short first and protect any pre-existing user changes.
   • Identify package managers, lockfiles, runtime version declarations, language-specific manifests, CI workflow files, Dockerfiles, Compose files, container build scripts, and checked-in automation that pins tools or images.
   • For this repository, expect pnpm, Go modules/workspaces, Node runtime pins, Go runtime/toolchain declarations, GitHub Actions, Dockerfiles, Compose files, and scripts.

2. Discover available updates

   • Check outdated JavaScript dependencies with pnpm tooling.
   • Check Go module updates with go list -m -u in each relevant module/workspace.
   • Check runtime updates for Node.js and Go by inspecting checked-in version pins and current upstream stable releases when needed.
   • Check CI workflow maintenance items, including pinned GitHub Actions versions, setup-node/setup-go versions, workflow tool versions, cache keys, package-manager setup steps, and runtime versions duplicated in workflow files.
   • Check Docker and container maintenance items, including base image tags, runtime/package-manager install steps, image build arguments, Compose image tags, and scripts that build or publish container artifacts.
   • Classify each available update as:
     • Low impact: patch/minor dependency updates within the declared compatible range, lockfile refreshes, non-breaking tool/action patch updates, and Docker base image patch or digest refreshes that stay on the same runtime and distro family.
     • Higher risk: major dependency updates, framework/compiler/runtime version changes, package-manager major changes, Go/Node major or policy changes, GitHub Actions major changes, CI environment or permission changes, Docker base image major/distro-family changes, generated-code-affecting upgrades, or anything with visible migration notes.

3. Auto-adopt only low-impact updates

   • Apply low-impact updates directly.
   • Keep changes minimal and scoped to dependency/runtime metadata, lockfiles, workflow files, Docker/container metadata, and scripts that only pin versions.
   • Run the package-manager/go tidy commands needed to make lockfiles and sums consistent.
   • Keep runtime pins aligned across manifests, CI workflows, Dockerfiles, and scripts when adopting a runtime or package-manager version.
   • Do not auto-apply higher-risk updates.

4. Validate

   • Run the repository CI using /ci after low-impact changes are applied.
   • When workflow or Docker/container files changed, also run the relevant local validation commands available in the repository, such as workflow formatting, shell checks, Docker build checks, or targeted tests for build scripts.
   • If CI fails, diagnose and fix issues caused by the adopted upgrades, then rerun /ci until it passes or a clear blocker remains.

5. Report and ask about higher-risk upgrades

   • Summarize the low-impact changes that were applied, including files changed.
   • State the CI result.
   • Explicitly call out any CI workflow, Dockerfile, Compose, or automation changes, including which tool/image/action pins moved and whether runtime pins remain consistent across the repo.
   • List higher-risk upgrades that are available but not applied. For each, include: current version, available version, why it is higher risk, expected migration or validation work, and a recommendation.
   • Ask the user which, if any, higher-risk upgrades they want to accept next.
   • Do not commit changes unless the user explicitly asks.

Important constraints:

• Preserve unrelated user changes.
• Prefer pnpm over npm/yarn.
• Use Go 1.26 style guidance from AGENTS.md when Go files must change.
• Update relevant docs only if runtime/dependency policy or developer commands change.