Documents

Dependency Upgrade

Try it

Use when diagnosing frontend build failures, runtime errors, UI anomalies, API/data problems, white screens, request failures, or unexplained production exceptions; Chinese triggers include debugging, debug, troubleshooting, positioning, error reporting, exceptions, white screens, request failures.

What it does

适用于前端依赖升级、漏洞修复、大版本迁移和 lockfile 风险评审。需要具体流程和检查清单时加载 references/dependency-upgrade-workflow.md。

The skill document

依赖升级

适用于前端依赖升级、漏洞修复、大版本迁移和 lockfile 风险评审。需要具体流程和检查清单时加载 references/dependency-upgrade-workflow.md。

Purpose

用来源驱动和小批验证的方式升级依赖,降低破坏性变更、供应链风险和 CI 回归。

Procedure

  1. 建立事实基线:读取 package manager、lockfile、Node 版本、workspace 范围、CI 命令和当前验证状态。
  2. 分类升级目标:安全修复、补丁升级、小版本升级、大版本迁移、框架迁移、构建工具迁移或依赖清理。
  3. 查证来源:对版本敏感的库读取官方 release notes、migration guide、peer dependency、Node/browser 支持和弃用项。
  4. 拆小批次:安全补丁可集中处理;大版本、构建工具、框架和测试工具必须单独批次验证。
  5. 处理兼容边界:检查 ESM/CJS、TypeScript 类型、CSS 处理、SSR/RSC、插件 API、peer dependency 和 polyfill 变化。
  6. 运行验证矩阵:至少覆盖 install、typecheck、unit/component tests、build;关键应用补 E2E、Storybook 或手工冒烟。
  7. 同步文档:记录升级原因、版本、破坏性变更、迁移命令、回滚方式和仍需人工验证的路径。

Constraints

  • 不在缺少来源和验证的情况下进行大版本连跳。
  • 不为了消除 audit 警告盲目升级运行时关键包;先判断可利用路径和修复影响。
  • 不手工编辑 lockfile 规避依赖冲突。
  • 不把依赖升级和无关重构混在一个批次。
  • 不移除 peer dependency 或构建插件,除非有证据证明没有被运行时、子包或 CI 使用。

Expected Output

输出升级清单、风险分类、来源依据、批次策略、修改范围、验证命令、失败处理和回滚建议。完成后 lockfile 与 package 清单一致,关键验证通过,破坏性变更有记录。

Related skills

Generate and edit Draw.io, Mermaid, and Excalidraw diagrams from natural language using a structured JSON spec.

by nssa.io1.0k installs47 stars

Find why your productivity system keeps failing, then apply the smallest fix — capacity math, bottleneck routing, durable local notes.

by Iván855 installs69 stars

Fetch raw ad creative, app, ranking, and revenue data from AdMapix as structured JSON.

by fly0pants4.3k installs296 stars

Join a video meeting as an AI bot with voice, avatar, and screenshare across four operating modes.

by johnpatternai22 installs8 stars

Stores durable facts in a categorized, plain-markdown vault on disk, alongside your agent's built-in memory.

by Iván559 installs18 stars

More from bovinphang

Browse all skills

Generate or edit diagrams, visual assets, and image workflows with reviewable PNG self-checks and bounded self-repair.

by bovinphang9 installs1 stars

Use when creating editable technical diagrams with draw.io / diagrams.net sources, including architecture diagrams, ERD, UML, sequence diagrams, flowcharts, ML model diagrams, official shape lookup, brand symbols, Graphviz auto-layout, codebase structure maps, .drawio validation, or draw.io CLI expo

by bovinphang5 installs

Use when building, reviewing, or improving frontend UI that needs product-specific design direction, design-system generation, Master/Page overrides, distinctive visual identity, anti-generic interface choices, first-screen hierarchy, UI polish, chart UX, interaction states, responsive behavior, or

by bovinphang8 installs

Use when creating or reviewing Next.js 14+ App Router projects, file routes, layouts, server/client component boundaries, SSR/SSG/ISR, streaming, metadata, middleware, server actions, or Next-specific data fetching. For generic client React component architecture, apply the project's React conventio

by bovinphang10 installs1 stars

Use when creating, reviewing, or restructuring frontend monorepos with pnpm workspace, Turborepo, Nx, multi-package dependency boundaries, task orchestration, package naming, or package publishing; Chinese triggers include monorepo, workspace, multi-package.

by bovinphang10 installs1 stars

Use when creating or reviewing Nuxt 3 projects, file routes, pages, layouts, SSR/SSG/SPA behavior, Nuxt data fetching, route middleware, plugins, modules, server routes, or Nuxt-specific Vue 3 conventions. For generic Vue component architecture, apply the project's Vue conventions separately; Chines

by bovinphang10 installs1 stars