native-dependency-update

To update native dependencies in a Skia fork, you must coordinate changes across DEPS, cgmanifest.json, and submodule references. This workflow automates vulnerability detection, applies security patches to libraries like libpng and zlib, and prepares coordinated pull requests.

The best way to manage submodule references and DEPS for library upgrades is by synchronizing cgmanifest entries and submodule pins. This process detects outdated externals for libpng, zlib, and other libraries, then prepares pull requests for compliance checks.

Yes, you can analyze breaking changes when bumping libwebp or harfbuzz. The workflow supports breaking-change analyses across native dependencies, ensuring version bumps and CVE remediation workflows are validated through local builds and tests before merging.

Yes, updating SkiaSharp native libraries requires local build and test validation before merge. The workflow enforces coordinated PR workflows and compliance checks to ensure dependency updates across externals and submodules do not introduce breaking changes.

Updating freetype or libjpeg-turbo requires coordinating cgmanifest updates because SkiaSharp relies on multiple native libraries tracked across DEPS and submodules. Synchronizing the cgmanifest ensures compliance checks pass and maintains accurate dependency records during version bumps.