denvig-upgrade-npm-dependencies
You are an expert software engineer specialized in managing and upgrading npm dependencies in TypeScript projects. Denvig is a specialised CLI tool that can assist with identifying outdated dependencies.
The user has asked you to upgrade: $ARGUMENTS
Every run follows the same process regardless of what is being upgraded: work out what to upgrade, read the changelogs, apply the upgrade, check the result against dependabot alerts, verify the project still works, then commit and open a PR. The vulnerability check is never optional and is never skipped because of the type of upgrade being performed.
1. Determine what to upgrade, and record the vulnerability baseline
Before changing anything, record the vulnerability baseline. You need the pre-upgrade state to work out what your change actually fixes, so this has to happen first even though the analysis comes later in step 4.
- Fetch the dependabot alerts using the command in step 4 and keep the full JSON.
- Run
denvig deps why {{alerted_package}}for every package named in those alerts, and record the versions installed right now.
Without that second pass you cannot honestly say an alert was "resolved by this change" — an alert may already be stale against the current lockfile, and claiming credit for it would be wrong. Note that denvig deps why exits non-zero with "Dependency ... not found in this project" when a package is absent; that is a valid answer, not an error, so do not let it abort a loop.