Treat an upgrade as a synchronization task, not a lockfile refresh. Derive versions, commands, and compatibility points from the current repository.

Discover

Read affected manifests and scripts, pnpm-workspace.yaml, setup actions, workflows, test configuration, and compatibility documentation.
Search for the dependency and every current version, range, runtime input, image, engine constraint, patch, and compatibility claim.
Record each match as a development version, tested version, peer range, engine minimum, advertised minimum, or intentionally different constraint.
When adding or moving a manifest entry, read manifest-roles.md before selecting its role.
Select the package-local or coordinated branch and its validation matrix.

Discovery is complete when every match and affected validation surface is accounted for.

dependency-maintenance