Services

Dependency Update Baseline

Dependency update baseline

Date: 2026-06-22

Goal: answer whether this repo needs dependency updates without changing dependency manifests or lockfiles.

Scope inventoried#

  • Frontend/workspace package surface: pnpm-workspace.yaml, root package.json, pnpm-lock.yaml, app packages under apps/*, shared packages under packages/*, and tool packages under tools/*.
  • Backend package surface: backend/go.mod and backend/go.sum.
  • Command surface: .mise.toml, .docs/developer.md, root pnpm scripts, and backend Makefile conventions.

Working-tree note: before this audit, apps/ui-library/public/llms.txt was already modified. This audit intentionally did not touch or stage it.

Commands run#

1
$ mise exec -- pnpm outdated -r --format json > /tmp/assistance-pnpm-outdated.json
2
exit: 1

Result summary from parsed output:

1
outdated packages: 250
2
deprecated packages: 7
3
major-version latest available: 117
4
minor/patch latest available: 133

Representative frontend/tooling updates visible in the output:

1
next 15.5.15 -> 16.2.9
2
react 18.3.1 -> 19.2.7
3
react-dom 18.3.1 -> 19.2.7
4
typescript 5.9.3 -> 6.0.3
5
vite 7.3.2 -> 8.0.16
6
vitest 4.1.4 -> 4.1.9
7
turbo 2.9.6 -> 2.9.18
8
@opennextjs/cloudflare 1.18.0 -> 1.19.11
9
wrangler 4.78.0 -> 4.100.0
10
ai 5.0.52 -> 6.0.208
11
@ai-sdk/openai 2.0.101 -> 3.0.74

Deprecated packages reported by pnpm outdated:

1
@types/markdown-table@3.0.0
2
mdast@3.0.0
3
@types/mdx-js__react@1.5.8
4
@types/react-datepicker@4.19.6
5
@types/react-grid-layout@1.3.6
6
@types/recharts@1.8.29
7
@types/uuid@8.3.4
1
$ mise exec -- pnpm audit --json > /tmp/assistance-pnpm-audit.json
2
exit: non-zero

Audit metadata:

1
info: 0
2
low: 31
3
moderate: 137
4
high: 91
5
critical: 5
6
total dependencies scanned: 3526

Representative advisories in the output included next, form-data, lodash.template, handlebars, tar, js-yaml, qs, h3, prismjs, request, tough-cookie, minimist, jpeg-js, and url-regex.

1
$ mise exec -- pnpm audit --audit-level high --json > /tmp/assistance-pnpm-audit-high.json
2
exit: 1

The high-threshold audit still fails, so the frontend/workspace dependency assessment should prioritize reachable high/critical advisories before routine version freshness.

1
$ cd backend && mise exec -- go list -m -u -json all > /tmp/assistance-go-list-updates.json
2
exit: 0

Parsed Go update summary:

1
modules with newer versions available: 49

Representative Go updates:

1
github.com/gin-gonic/gin v1.11.0 -> v1.12.0
2
github.com/go-playground/validator/v10 v10.27.0 -> v10.30.3
3
github.com/jackc/pgx/v5 v5.6.0 -> v5.10.0
4
github.com/lib/pq v1.10.9 -> v1.12.3
5
github.com/meilisearch/meilisearch-go v0.36.1 -> v0.36.3
6
github.com/quic-go/quic-go v0.54.0 -> v0.60.0
7
golang.org/x/crypto v0.47.0 -> v0.53.0
8
golang.org/x/net v0.48.0 -> v0.56.0
9
golang.org/x/sys v0.40.0 -> v0.46.0
10
golang.org/x/text v0.33.0 -> v0.38.0
11
golang.org/x/tools v0.40.0 -> v0.46.0
12
google.golang.org/protobuf v1.36.9 -> v1.36.11
1
$ cd backend && mise exec -- govulncheck -version
2
mise ERROR "govulncheck" couldn't exec process: No such file or directory

govulncheck is not installed in the current mise-managed environment, so Go vulnerability reachability was not proven in this baseline.

Initial answer#

Yes, the repo needs dependency update work, but not as a single broad upgrade.

The evidence points to three separate tracks:

  1. Security triage first: pnpm audit --audit-level high fails and reports high/critical advisories. The next task should identify which advisories are reachable from shipped apps versus build/test-only or stale transitive paths.
  2. Routine patch/minor updates: many patch/minor updates are available in both pnpm and Go surfaces. These should be batched by ecosystem and verified with focused tests.
  3. Deferred major migrations: Next 16, React 19, TypeScript 6, Vite 8, AI SDK 6, and related tooling are major-version upgrades and should be planned separately because this repo has multiple Next apps, OpenNext/Cloudflare deployment surfaces, React 18 packages, and Studio-specific catalog constraints.
  • Frontend slice: parse pnpm audit paths, group high/critical advisories by direct dependency and workspace package, and identify low-risk patch/minor upgrade batches.
  • Frontend slice: separate default catalog updates from catalog:studio; Studio has its own compatibility catalog and should not be upgraded casually with the public apps.
  • Backend slice: run go list -m -u all, inspect security-sensitive modules (golang.org/x/*, gin, jwt, gorm, pgx, meilisearch-go), and install/run govulncheck only if approved or already available in the managed environment.
  • Final recommendation: produce a prioritized update plan rather than editing package.json, pnpm-lock.yaml, go.mod, or go.sum in this audit pass.