sdcorejs-dep-update

Safe dependency upgrades require classifying patch, minor, and major risks, then upgrading one logical group at a time with lockfile diff sanity checks and full test runs. This workflow prevents regressions and reduces lockfile churn across NestJS, Next.js, and Angular Portal projects.

Handling Dependabot PRs and npm audit remediation involves prioritizing Critical and High security findings, applying incremental upgrades, and running stack-specific smoke verification. This ensures security patches are reviewable, reversible, and verifiable before merging into production.

Dependency updates are blocked on main or master branches to enforce safety. The workflow requires a clean working tree and a dedicated branch, ensuring upgrades remain incremental, reversible, and isolated from production code until full test and lint validation passes.

Lockfile diffs provide sanity checks during package updates by exposing unexpected version changes or transitively pulled dependencies. Reviewing these diffs after upgrading one logical group ensures you catch lockfile sludge and maintain deterministic builds across npm, yarn, and pnpm.

Yes, the workflow treats @sd-angular/core as pinned by referencing _refs/angular-portal/core-version.md. It enforces pinned core constraints during semver classification, ensuring major version bumps do not accidentally break your Angular Portal stack during routine dependency refreshes.

Upgrading dependencies without a test suite triggers a safety warning. The workflow enforces full test and lint runs to verify stack-specific smoke checks, so missing tests increase regression risk and prevent automated validation of your npm or yarn package updates.