Discover package manager, lockfile, engines, workspace layout and upgrade policy. Record existing check failures so an upgrade is neither blamed for nor credited with them.
Inventory outdated direct dependencies, relevant transitive constraints and advisories from current registry/vendor data. Read each changelog and migration guide for breaking changes, runtime requirements, peer ranges, renamed APIs and codemods. Never guess release notes.
Upgrade one compatibility group at a time: tightly coupled packages such as framework and renderer, test runner and coverage provider, compiler and its tooling. Keep independent majors separate, but never gate halfway through a vendor-required paired upgrade.
Change manifests and the lockfile through the package manager, respecting pinning policy. Never hand-edit resolution/integrity data, bypass peer checks or disable verification. Review unexpected transitive or install-script changes.
Apply documented migrations, then run targeted behavior checks, repository gates and a frozen install. Patch/minor labels don't replace verification.
Report each group updated with evidence and behavior changes, and anything held back with its compatibility reason and unblock condition. Don't claim the whole graph is current from a top-level check.

Anti-patterns

Done when

Use flow-review for the upgrade diff or flow-migrate for a separately scoped API transformation.