amio/dot-agents/npm-upgrade-audit

npm Upgrade Audit

Audit outdated npm dependencies and evaluate whether new features can improve the project.

Workflow

1. Run npm outdated

npm outdated --json

The command exits with code 1 when outdated packages exist — that is expected. Parse the JSON from stdout/stderr.

2. Classify by semver bump

For each outdated package, compare current vs latest:

• MAJOR: leading segment changed (e.g. 24 → 25)
• MINOR: middle segment changed (e.g. 42.2 → 42.3)
• PATCH: trailing segment changed (e.g. 1.66.0 → 1.66.1)

Focus analysis on minor and major bumps. Patch bumps are safe to update without review.

3. Fetch changelogs for minor+ bumps

For each package with a minor or major bump, fetch its release notes:

• GitHub releases: https://github.com/{org}/{repo}/releases/tag/v{version}
• npm package page: https://www.npmjs.com/package/{name}
• Official changelog/blog if hosted elsewhere (e.g. https://nodejs.org/en/blog/release/v{version})

Extract new features, breaking changes, deprecations, and notable bug fixes.

4. Inspect project usage

For each minor+ bump, search the codebase for how the package is currently used:

• Search for imports of the package
• Search for key APIs that changed in the new version
• Read relevant source files to understand integration depth

5. Evaluate each update

For each package, answer:

6. Produce a structured report

Output a table per package with:

• Action: Upgrade / Hold / Pin
• Breaking changes: Yes / No / Summary
• Code changes needed: Description or "None"
• Recommendation: Concise rationale