LucasSantana-Dev dep-lifecycle
Full dependency lifecycle: audit → triage → upgrade → verify → ship.
Phases
Phase 1 — Audit
Run the scanner: npm audit --json (Node), pip-audit (Python), cargo audit (Rust).
Fetch open dependency PRs: gh pr list --label "dependencies" --json number,title,headRefName.
Output: vulnerabilities ranked by severity + stale packages by version lag.
Phase 2 — Triage
| Class | Trigger | Action |
|---|---|---|
| CVE critical/high | CVSS ≥7 | Upgrade now |
| Breaking major | semver major | Separate PR; read migration guide first |
| Routine minor/patch | semver minor/patch | Batch into one PR |
| No upstream fix | vuln with no fix | Document + open issue; do not block sweep |
Skip any dependency where the vulnerable API is provably not called (grep for usage; zero hits → dismiss).
Phase 3 — Upgrade (targeted, not blanket)
Upgrade each targeted package individually. Run a smoke check after each upgrade.
Do NOT run npm update or pip install --upgrade-all.
Phase 4 — Verify
Run full quality gates. If tests fail after an upgrade: isolate → revert → open follow-up issue. Do not block the whole sweep for one hard upgrade.
Phase 5 — Ship
- Patches + minors: one PR with all low-risk upgrades
- Majors: one PR per major (separate review context)
PR title: chore(deps): bump <package(s)> to <version(s)>
Reconciliation
DEP LIFECYCLE — <date>
Phase 1 Audit: N vulnerabilities, M stale packages ✅
Phase 2 Triage: X critical/high, Y routine, Z dismissed ✅
Phase 3 Upgrade: <packages + versions> ✅
Phase 4 Verify: PASS | <N packages reverted> ✅
Phase 5 Ship: PR(s) <numbers> ✅
Failure / Stop Conditions
- Phase 2: CVE with no upstream fix IS actively called → halt, escalate to user.
- Phase 3: major upgrade breaks >2 test files → revert, document, continue with rest.
- Phase 4: do not ship if any required gate is red due to an upgrade in this sweep.
- Never batch a major upgrade with routine patches.