Editorial recipe — not benchmarked — reviewed September 3, 2026
Review and land a dependency upgrade safely
For teams that need dependency automation without delegating the merge decision.
Run this recipe
Work through it here
Progress stays in this browser. The downloaded Markdown kit works in any notes app or repository.
0/5 complete
Is this recipe useful?
Procedure
- Configure Renovate to propose a narrow, pinned update with release notes and dependency files visible; avoid grouping unrelated major upgrades.
- Record the before state, supported runtime range, direct and transitive changes, lockfile diff, and rollback version before asking an agent to modify application code.
- Run OSV-Scanner on supported manifests and Semgrep on changed code, treating findings as review inputs rather than proof that the upgrade is safe.
- Ask the coding agent to make only compatibility changes required by documented breakage, then run unit, integration, build, and representative runtime checks.
- Have a different reviewer inspect the dependency provenance, migration assumptions, scan findings, diff, checks, and rollback plan before a person approves the merge.
Acceptance artifact
A scoped upgrade proposal, dependency and lockfile diff, scan evidence, compatibility patch, passing runtime proof, and rollback record
Do not use it blindly
Automated updates and clean scans do not prove compatibility or absence of vulnerabilities; review install scripts, maintainers, licenses, and runtime behavior.