# Dependency Update

> Review, apply, verify, or merge gocron dependency updates from Dependabot or manual requests. Use for Go modules, root/admin/docs pnpm packages, GitHub Actions, Docker base images, security advisories, lockfile conflicts, or dependency update pull requests.

- Skill: `gocronx-team/dependency-update` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add gocronx-team/dependency-update`
- Raw SKILL.md: https://api.skillmd.com/api/skills/gocronx-team/dependency-update/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: gocronx-team (https://skillmd.com/u/gocronx-team)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/gocronx-team/dependency-update

---


# Update gocron dependencies

Handle one dependency group and ecosystem at a time unless a security fix
requires coordinated versions. A request to inspect a PR or alert is read-only;
merge, dismiss, commit, and push only when explicitly requested.

## Assess before changing

- Inspect the manifest and lockfile diff, release notes, advisory, dependency
  graph, and current CI status. Use primary upstream documentation.
- Classify the update as patch, minor, major, security, development-only, build
  tooling, GitHub Action, or runtime/container.
- Determine whether the dependency is direct, transitive, bundled into the
  frontend, shipped in the image, or used only in tests.
- For security alerts, record the vulnerable range, fixed version, severity,
  reachable code path, and whether every affected workspace is updated.
- Treat major updates, Go/toolchain changes, framework upgrades, database
  drivers, schedulers, RPC libraries, auth/crypto packages, and container bases
  as high risk even when the diff is small.

Never edit a lockfile by hand. Use the repository package manager and preserve
its existing lockfile format. Do not silence peer dependency failures or add
blanket advisory ignores to make a check green.

## Apply the smallest update

Use the narrowest ecosystem command that updates the requested package and its
required peers. Review the resulting diff for unrelated upgrades, install
scripts, new transitive packages, license changes, and unexpected engine or Go
version changes. Revert unrelated generated churn without discarding
pre-existing user changes.

For a Dependabot PR, prefer checking out or updating its branch rather than
reconstructing a different lockfile locally. If the branch is stale, rebase or
regenerate only when the user authorized changes to that PR.

## Verify by ecosystem

- Go runtime dependency: run `go mod tidy`, ensure `go.mod` and `go.sum` contain
  only expected changes, then run affected package tests with `-race`,
  `go vet ./...`, and `govulncheck ./...` when available.
- Admin frontend: run `pnpm --dir web/gocronx-admin build-only`,
  `pnpm --dir web/gocronx-admin exec vue-tsc --noEmit`, and
  `pnpm --dir web/gocronx-admin lint`.
- Docs: run `pnpm --dir docs docs:build`.
- Root tooling: run the affected commit/lint hook command and verify the admin
  workspace lockfile was not unintentionally changed.
- GitHub Action: validate YAML and inspect the referenced action's changelog and
  immutable tag/SHA policy.
- Docker/base image: build `Dockerfile.gocron` and inspect architecture,
  runtime user, binary/library compatibility, and vulnerability scan results.

Run the relevant package tests even if the dependency is marked dev-only.
Invoke `$verify` before merge for every code or lockfile update.

## Decide and report

State the exact old/new versions, why the update is needed, runtime exposure,
breaking-change review, manifest/lockfiles changed, audit result, checks run,
and remaining risk. Recommend merge only when required checks are green and the
diff contains no unexplained dependency churn.

If committing, use one single-line Conventional Commit subject under 100
characters and no `Co-Authored-By`, for example:

```text
chore(deps): update vue to 3.6.0
```