Inputs
- Pinned current dependency state
- Target release and official notes
- Compatibility constraints
- Relevant test commands
Control points
- Official release sources
- Lockfile and transitive-diff review
- No unrelated upgrades
- Rollback path
Human approval gate
A maintainer owns the dependency decision and approves compatibility, security, licensing, test evidence, and rollback before merge.
The workflow
Every step includes a check that can stop the process before risk moves downstream.
- 01
Confirm the upgrade reason
State the bug, support, security, or maintenance need and the acceptable target range.
Gate: The target is intentional rather than an unbounded latest-version request. - 02
Read primary release evidence
Review official notes, migration guidance, advisories, and runtime requirements.
Gate: Material compatibility claims link to their source. - 03
Generate a bounded change
Update the direct dependency and lock state while separating unrelated transitive movement.
Gate: Unexpected packages or scripts are reviewed before execution. - 04
Test affected behavior
Run build, type, unit, integration, and security checks selected for the dependency surface.
Gate: Failures and skipped environments remain visible. - 05
Approve or defer
A maintainer reviews the diff, residual risk, deployment observation, and rollback steps.
Gate: The decision record explains why the upgrade is safe enough or blocked.
Candidates to pilot
Inclusion means relevant product shape, not measured superiority.
Sources checked
Open the original pages before relying on a time-sensitive product decision.