Dependency maintenance

Inspect

Follow repository guidance. Read package.json, the lockfile, and .npmrc; preserve existing user changes.
Read relevant dated dependency decisions in the target project's .agents/dependencies/; the latest decision for each package supersedes earlier entries.
Use the project's package manager and pinned Node/npm versions. Check npm outdated --json and npm audit --json; a nonzero exit can indicate findings rather than a command failure.
For audit-only requests, report findings without editing files. For updates, stay within the requested packages or Dependabot change.

When scope is unspecified, prefer stable patch and minor updates in small coherent batches. Handle majors separately; consult official release notes and migration guides, check engines and peer dependencies, and implement migrations when requested.
Keep related packages compatible, especially Prisma client/adapter/CLI and Vitest/coverage/UI. Semver compatibility alone does not guarantee a harmless update.
Prefer targeted updates over updating everything to latest. Preserve version-range conventions and the lockfile; inspect the diff for unrelated changes.
For vulnerabilities, inspect the advisory and dependency path (npm explain <package>). Prefer updating the introducing dependency; use a narrow override only with a compatibility check and a recorded reason. Review existing overrides for removal when no longer needed.
Do not use npm audit fix --force or --legacy-peer-deps to bypass incompatibilities. Review newly required install scripts before changing permissions.
Investigate unused dependencies or bundle size only when relevant or requested. Confirm actual usage before removing a package, including Nuxt auto-imports, modules, configuration, and scripts.