# Mern Deps

> Check and update dependencies safely with security audits and test verification.

- Skill: `majiayu000/mern-deps` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds add majiayu000/mern-deps`
- Raw SKILL.md: https://api.skillmd.com/api/skills/majiayu000/mern-deps/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: majiayu000 (https://skillmd.com/u/majiayu000)
- Updated: 2026-09-09
- Page: https://skillmd.com/skills/majiayu000/mern-deps

---


## Purpose
Manage dependencies safely: audit for vulnerabilities, check for updates, and update with test verification.

## Arguments
- `--check` — Check for outdated packages (default if no args)
- `--audit` — Run security audit
- `--update` — Update patch/minor versions with test verification
- `--update-major` — Show available major updates (requires manual review)

## Workflow

### Check (`--check`)
1. Run `pnpm outdated`
2. Categorize: patch, minor, major
3. Report packages with updates available
4. Flag packages with known issues

### Audit (`--audit`)
1. Run `pnpm audit`
2. Report vulnerabilities by severity (critical, high, moderate, low)
3. Suggest fixes for critical/high
4. Check for patches available

### Update (`--update`)
1. Show packages to update (patch + minor only)
2. **Ask for approval**
3. Update packages: `pnpm update`
4. Run tests: `pnpm test`
5. Run build: `pnpm build`
6. If tests pass, commit changes
7. If tests fail, rollback and report

### Major updates (`--update-major`)
1. List packages with major updates
2. Show changelogs/breaking changes (if available)
3. Recommend update order (dependencies first)
4. Do not auto-update — requires manual review

For universal safety rules and update priority order, see `/shared-deps-safety`.

## Output

### Check output
```
Outdated packages:

Patch updates (safe):
  - zod: 3.22.4 → 3.22.5
  - mongoose: 8.0.1 → 8.0.3

Minor updates (usually safe):
  - next: 14.1.0 → 14.2.1
  - @types/node: 20.10.0 → 20.11.0

Major updates (review required):
  - eslint: 8.56.0 → 9.0.0 ⚠️ Breaking changes
```

### Audit output
```
Security audit:

Critical: 0
High: 1
  - lodash <4.17.21 (Prototype Pollution)
    Fix: pnpm update lodash
Moderate: 2
Low: 3

Run `pnpm audit fix` to auto-fix where possible.
```

## Reference
For update strategies and common issues, see `reference/mern-deps-reference.md`