You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
|`pyproject.toml` / `requirements.txt`| Python (pip/uv/poetry) |`pip list --outdated` · `uv pip list --outdated` · `poetry show --outdated`|`pip install -U -r requirements.txt` · `uv lock --upgrade` · `poetry update`| edit specifiers · `uv lock --upgrade` · `poetry update --latest`|`pip-audit --strict`| pin in `requirements.txt` / `constraints.txt` / `>=` in pyproject |
29
+
|`*.csproj` / `Directory.Build.props`| .NET (NuGet) |`dotnet list package --outdated --include-transitive`|`dotnet add <proj> package <Name>` (per package) or `dotnet outdated --upgrade`| same |`dotnet list package --vulnerable --include-transitive`| explicit `<PackageReference Version>` in consuming project, or `<PackageVersion>` in `Directory.Packages.props`|
30
+
|`go.mod`| Go |`go list -m -u all`|`go get -u ./... && go mod tidy`| same |`govulncheck ./...`|`replace` directive in go.mod |
31
+
|`Gemfile`| Ruby |`bundle outdated`|`bundle update`| edit Gemfile constraints then `bundle update`|`bundle audit check --update`| explicit version constraint in Gemfile |
32
+
|`composer.json`| PHP |`composer outdated`|`composer update`| edit constraints then `composer update`|`composer audit`| explicit version in composer.json |
33
+
|`pubspec.yaml`| Dart/Flutter |`dart pub outdated`|`dart pub upgrade`|`dart pub upgrade --major-versions`|`dart pub deps` + check https://osv.dev| explicit version in pubspec.yaml |
34
+
|`build.gradle(.kts)`| Gradle |`./gradlew dependencyUpdates`| edit versions then `./gradlew dependencies`| same |`./gradlew dependencyCheckAnalyze` (OWASP) | version catalog entry |
35
+
|`pom.xml`| Maven |`mvn versions:display-dependency-updates`|`mvn versions:use-latest-releases && mvn versions:commit`| same | OWASP `dependency-check`| explicit `<version>` in pom.xml |
37
36
38
-
If multiple languages are present, process each one in order.
37
+
Install scanner binaries if missing (`cargo install cargo-audit`, `pip install pip-audit`, `go install golang.org/x/vuln/cmd/govulncheck@latest`, `gem install bundler-audit`). Do not skip a scan because the tool is missing.
39
38
40
-
**If you cannot detect any manifest file, stop and tell the user.**
**Read the docs:**https://docs.gradle.org/current/userguide/dependency_management.html
114
-
115
-
### Java (Maven)
116
-
```bash
117
-
mvn versions:display-dependency-updates
118
-
```
119
-
**Read the docs:**https://www.mojohaus.org/versions/versions-maven-plugin/display-dependency-updates-mojo.html
120
-
121
-
If `--check-only` was passed, **stop here** and report the outdated list.
122
-
123
-
## Step 3 — Read the official upgrade docs
124
-
125
-
**Before running any upgrade command, you MUST fetch and read the official documentation URL listed above for the detected package manager.** Use WebFetch to retrieve the page. This ensures you use the correct flags and understand the behavior. Do not guess at flags or options from memory.
126
-
127
-
## Step 4 — Upgrade packages
128
-
129
-
Run the upgrade. If a specific package name was given as an argument, upgrade only that package.
130
-
131
-
### Rust
132
-
```bash
133
-
cargo update # semver-compatible updates
134
-
# --major flag:
135
-
cargo update --breaking # major version bumps (cargo 1.84+)
For `Directory.Build.props`, edit the version numbers directly in the XML.
47
+
Run the "Outdated" column command for each detected ecosystem and show the diff to the user. If `--check-only`, stop here.
174
48
175
-
**Read the docs:**https://learn.microsoft.com/en-us/dotnet/core/tools/dotnet-add-package
49
+
## Step 3 — Upgrade
176
50
177
-
Alternatively, use the dotnet-outdated global tool:
178
-
```bash
179
-
dotnet tool install --global dotnet-outdated-tool
180
-
dotnet outdated --upgrade
181
-
```
182
-
**Read the docs:**https://github.com/dotnet-outdated/dotnet-outdated
51
+
Run the "Upgrade (semver)" column, or "Upgrade (`--major`)" if `--major` was passed. If a package name argument was given, scope the upgrade to that package.
183
52
184
-
### Go
185
-
```bash
186
-
go get -u ./... # update all dependencies
187
-
go mod tidy # clean up go.sum
188
-
```
189
-
For a specific package: `go get -u <module>@latest`.
53
+
## Step 4 — Build & test
190
54
191
-
### Ruby (Bundler)
192
-
```bash
193
-
bundle update # all gems
194
-
# specific gem:
195
-
bundle update <gem-name>
196
-
```
55
+
Run `make ci` (or the project's build/test commands from the Makefile, CI workflow, or CLAUDE.md). Fix any breakage using release notes / migration guides. If stuck after 3 attempts on the same failure, stop and report.
197
56
198
-
### PHP (Composer)
199
-
```bash
200
-
composer update # all packages
201
-
# specific package:
202
-
composer update <vendor/package>
203
-
```
204
-
With `--major`: edit `composer.json` version constraints first, then `composer update`.
57
+
## Step 5 — Vulnerability scan (MANDATORY)
205
58
206
-
### Java / Kotlin (Gradle)
207
-
Edit version numbers in `build.gradle` / `build.gradle.kts` / version catalogs (`libs.versions.toml`), then:
208
-
```bash
209
-
./gradlew dependencies # verify resolution
210
-
```
59
+
Upgrading top-level deps does NOT guarantee transitive deps are clean. Drive the count to **zero**.
211
60
212
-
### Java (Maven)
213
-
```bash
214
-
mvn versions:use-latest-releases # update pom.xml to latest releases
215
-
mvn versions:commit # remove backup pom
216
-
```
61
+
**5a. Scan** — run the "Audit" column for each ecosystem.
217
62
218
-
## Step 5 — Verify the upgrade
63
+
**5b. Read runtime constraints** — before pinning anything:
- Ruby: `.ruby-version` / `ruby` directive in Gemfile
219
70
220
-
After upgrading, run the project's build and test suite to confirm nothing broke:
71
+
**5c. For each advisory, pick the highest compatible fix:**
72
+
1. Look up the fixed-version range (scanner output, else [osv.dev](https://osv.dev) or [github.com/advisories](https://github.com/advisories)).
73
+
2. List published versions newest-first (`npm view <pkg> versions`, `pip index versions <pkg>`, `cargo search <pkg>`, `dotnet package search <pkg>`, `gem info <pkg>`).
74
+
3. Pick the newest version that is both in the fix range AND satisfies 5b's runtime floor. Prefer a major jump only when no lower major has a fix.
221
75
222
-
```bash
223
-
make ci
224
-
```
76
+
**5d. Apply via the "Override mechanism" column.** Scope narrowly when consumers disagree on major (e.g. `eslint` → `ajv@6` vs `secretlint` → `ajv@8`: override to `"parent > pkg"` not top-level).
225
77
226
-
If `make ci` is not available, run whatever build/test commands the project uses (check the Makefile, CI workflow, or CLAUDE.md).
78
+
**5e. Re-install, re-scan, iterate.** Loop 5c–5e until zero. If a previous override broke Step 4, re-scope and re-run Step 4.
227
79
228
-
If tests fail:
229
-
1. Read the failure output carefully
230
-
2. Check the changelog / migration guide for the upgraded packages (fetch the release notes URL if available)
231
-
3. Fix breaking changes in the code
232
-
4. Re-run tests
233
-
5. If stuck after 3 attempts on the same failure, report it to the user with the error details and the package that caused it
80
+
**5f. If zero is impossible** (no fix exists, or only fix needs an unauthorised runtime bump): list each residual advisory with package, installed version, advisory ID, severity, available fix version, reason not applied, recommended action. Do NOT suppress via `--omit=dev`, `audit.level`, allowlists, `--ignore-vuln`, etc.
234
81
235
82
## Step 6 — Report
236
83
237
-
Provide a summary:
238
-
239
-
- Packages upgraded (old version -> new version)
240
-
- Packages skipped (and why, e.g., major version bump without `--major` flag)
241
-
- Build/test result after upgrade
242
-
- Any breaking changes that were fixed
243
-
- Any packages that could not be upgraded (with error details)
84
+
- Packages upgraded (old → new)
85
+
- Packages skipped (and why — major without `--major`, etc.)
0 commit comments