zfinix/aster/dependency-upgrade

Dependency upgrade

1. See the landscape before touching anything. cargo outdated,

npm outdated, bun outdated: know which bumps are patch, minor, major.

1. One major at a time. Batch patch and minor bumps freely; each major

version gets its own upgrade, its own check run, and its own commit. A ten-major mega-bump that fails tells you nothing about which one broke.

1. Read the changelog for majors. Search for "breaking", "migration",

"removed". Five minutes of changelog beats an hour of compile-error archaeology.

1. Let the lockfile do its job. Regenerate it with the repo's own

manager, commit it with the manifest, and never hand-edit it.

1. Full check between steps. Build plus tests after each major, quick

check after the minor batch. The first red stops the line; fix or revert that bump before continuing.

1. Audit fixes are upgrades too. npm audit fix --force is a blind major

bump wearing a security costume; treat the flagged package to the same one-at-a-time process.

1. Report version deltas, not vibes. "tokio 1.38 to 1.41, serde pinned,

axum held back: 0.8 needs the router rewrite." The user should know what moved and what deliberately did not.