# Dependency Update

> Checks for outdated npm dependencies across the app-drawer workspace (root and packages/express-static-serve), facilitates user-guided updates, and verifies the project still starts cleanly and passes npm audit afterward.

- Skill: `anchit-choudhry/dependency-update` (Agent Skill)
- Install (CLI): `npx skillmds@latest add anchit-choudhry/dependency-update`
- Raw SKILL.md: https://api.skillmd.com/api/skills/anchit-choudhry/dependency-update/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: anchit-choudhry (https://skillmd.com/u/anchit-choudhry)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/anchit-choudhry/dependency-update

---


# Dependency Update Skill

Codifies the workflow already described in this repo's CLAUDE.md ("Security & Maintenance")
into a repeatable process. Covers the npm workspace as a whole - there is only one package today
(`express-static-serve`), but this runs from the repository root so it picks up new packages under
`packages/*` automatically.

## Workflow

1. **Check for updates**: Run `npm outdated` from the repository root.
2. **User review**: Present the outdated packages (current, wanted, latest) to the user.
3. **Selection**: Ask the user which packages to update and which to skip. Do not upgrade major
   versions without explicit confirmation, since a major bump can break the Express 5 /
   express-static-gzip / Helmet integration.
4. **Apply updates**: Run `npm update <package1> <package2> ...` for the selected packages (scoped
   to the correct workspace if the package isn't at the root).
5. **Audit**: Run `npm audit`. If vulnerabilities remain, run `npm audit fix` - never
   `npm audit fix --force`, per CLAUDE.md.
6. **Verify**: Start the server locally (`cd packages/express-static-serve && node server.js`)
   and confirm `GET /` returns `{ "status": "UP" }` before considering the update complete.

## Commands

- `npm outdated`: Check for available updates.
- `npm update [packages...]`: Update selected packages.
- `npm audit`: Check for known vulnerabilities.
- `npm audit fix`: Fix vulnerabilities automatically (never with `--force`).
- `node packages/express-static-serve/server.js`: Verify the server still starts and serves
  `GET /` correctly after updates.