Services

Dependency Update Final

Dependency update final recommendation

Date: 2026-06-22

Inputs:

  • docs/audits/dependency-update-baseline.md
  • docs/audits/frontend-dependency-update-assessment.md
  • docs/audits/backend-dependency-update-assessment.md

Short answer#

Yes, this repo needs dependency update work.

The evidence does not support a single broad dependency bump. It supports a prioritized update program:

  1. Urgent frontend/security triage for high/critical pnpm audit findings.
  2. Planned backend Go maintenance updates, starting with vulnerability tooling and golang.org/x/* modules.
  3. Safe routine patch/minor batches for tooling and UI packages.
  4. Deferred major migrations for framework/toolchain jumps such as Next 16, React 19, TypeScript 6, Vite 8, and AI SDK 6.

No package manifests, lockfiles, go.mod, or go.sum were changed by this assessment.

Exact evidence#

Frontend/workspace#

1
$ mise exec -- pnpm outdated -r --format json
2
exit: 1

Parsed output:

1
outdated package entries: 250
2
deprecated package entries: 7
3
major-version latest available: 117
4
minor/patch latest available: 133
1
$ mise exec -- pnpm audit --json
2
metadata: low 31, moderate 137, high 91, critical 5
1
$ mise exec -- pnpm audit --prod --json
2
metadata: low 23, moderate 109, high 64, critical 1

Important advisory clusters include next, protobufjs, axios, react-router, fast-uri, js-cookie, undici, form-data, handlebars, and lodash.template.

Backend Go#

1
$ cd backend && mise exec -- go list -m -u -json all
2
modules with newer versions available: 49

Runtime/security-sensitive updates include:

1
github.com/gin-gonic/gin v1.11.0 -> v1.12.0
2
github.com/jackc/pgx/v5 v5.6.0 -> v5.10.0
3
github.com/lib/pq v1.10.9 -> v1.12.3
4
github.com/meilisearch/meilisearch-go v0.36.1 -> v0.36.3
5
golang.org/x/crypto v0.47.0 -> v0.53.0
6
golang.org/x/net v0.48.0 -> v0.56.0
7
golang.org/x/sys v0.40.0 -> v0.46.0
8
golang.org/x/text v0.33.0 -> v0.38.0
9
golang.org/x/tools v0.40.0 -> v0.46.0
1
$ cd backend && mise exec -- govulncheck -version
2
mise ERROR "govulncheck" couldn't exec process: No such file or directory
1
$ cd backend && mise exec -- go test ./...
2
exit: 0

Urgent updates / investigations#

  1. Frontend pnpm high/critical audit triage

    • pnpm audit --prod still reports 1 critical and 64 high advisories.
    • Start with production paths involving next, protobufjs/@grpc/grpc-js, axios, react-router, fast-uri, and js-cookie.

  2. Next.js security patch strategy

    • Audit paths include academy, studio, and blog through next.
    • Do not jump everything directly to Next 16. First identify patched lines compatible with each app and OpenNext/Cloudflare target.

  3. Academy/contentlayer protobuf path

    • The production audit reports a critical protobufjs path through contentlayer2/OpenTelemetry/grpc tooling.
    • Determine whether it is build-only or runtime-reachable; patch or isolate accordingly.

  4. Go vulnerability reachability

    • govulncheck is missing. Add/run it before claiming backend vulnerability status.

Safe routine updates#

Good follow-up branches after security triage:

  • Turbo patch updates (2.9.6 -> 2.9.18)
  • Vitest patch updates (4.1.4 -> 4.1.9) and matching @vitest/*
  • Radix UI patch updates
  • OpenNext patch/minor update (@opennextjs/cloudflare 1.18.0 -> 1.19.11) with Cloudflare build verification
  • Wrangler patch/minor update (4.78.0 -> 4.100.0) with patched dependency checks
  • Backend golang.org/x/* maintenance batch
  • Backend runtime module batch: gin, pgx, lib/pq, meilisearch-go, protobuf

Deferred major migrations#

Plan separately, with compatibility matrices and focused verification:

  • Next 15 -> 16
  • React 18 -> 19
  • TypeScript 5.9 -> 6.0
  • Vite 7 -> 8
  • @vitejs/plugin-react 5 -> 6
  • AI SDK 5 -> 6 / @ai-sdk/openai 2 -> 3

These changes affect many apps, package peer ranges, OpenNext/Cloudflare builds, and the Studio catalog. They should not be bundled with security patch triage.

Frontend security triage:

1
mise exec -- pnpm audit --prod --json > /tmp/assistance-pnpm-audit-prod.json
2
mise exec -- pnpm audit --audit-level high

Frontend update branch verification, adjusted to touched packages:

1
mise exec -- pnpm install --lockfile-only
2
mise run typecheck
3
mise run test
4
mise run build:pick -- www,docs,blog
5
mise run perf:cf-budgets -- --app www --app docs --app blog --allow-missing

Backend vulnerability check and maintenance branch:

1
cd backend
2
mise exec -- go run golang.org/x/vuln/cmd/govulncheck@latest ./...
3
mise exec -- go list -m -u all
4
mise exec -- go test ./...

Backend update verification:

1
cd backend
2
mise exec -- go mod tidy
3
mise exec -- go test ./...
4
cd ..
5
mise run build:backend

Frontend security retry note#

The security retry keeps apps/academy on the Next 14 line and uses the latest available patch release, next 14.2.35. The remaining production audit highs for Academy list patched versions only on the Next 15 line (>=15.0.8, >=15.5.15, or >=15.5.16), so there is no Next 14 patch-line or transitive override that clears those advisories. Per the retry constraint, Academy was not migrated to Next 15 and its Next 14 runtime/build compatibility remains unchanged.

The same retry remediates the other targeted high/critical production paths with patch-line package updates and pnpm overrides: default Next 15 apps, existing Studio Next 16 patch, protobufjs/@grpc/grpc-js/contentlayer transitive stack, axios/form-data, react-router/nuqs, fast-uri, js-cookie, hono, undici, ws, and related parser/utility transitives.

Final recommendation#

Proceed with dependency updates, but split the work:

  • First: security-focused frontend audit remediation.
  • Second: backend Go vulnerability tooling plus golang.org/x/* and runtime module updates.
  • Third: routine frontend tooling/UI patch-minor batches.
  • Later: major framework/toolchain migrations.

This approach reduces risk and gives each update class an appropriate verification surface.