Services

Frontend Dependency Update Assessment

Frontend/workspace dependency update assessment

Date: 2026-06-22

Baseline: docs/audits/dependency-update-baseline.md

Scope: pnpm workspace dependencies in root, apps/*, packages/*, tools/*, catalogs in pnpm-workspace.yaml, and lockfile/audit state. This assessment does not change package.json, pnpm-lock.yaml, or catalog versions.

Commands and evidence#

1
$ mise exec -- pnpm outdated -r --format json > /tmp/assistance-pnpm-outdated.json
2
exit: 1

Parsed summary:

1
outdated package entries: 250
2
deprecated package entries: 7
3
entries where latest is a major-version jump: 117
4
entries where latest is minor/patch within the same major line: 133

Important outdated packages visible in the output:

1
next 15.5.15 -> 16.2.9
2
react 18.3.1 -> 19.2.7
3
react-dom 18.3.1 -> 19.2.7
4
typescript 5.9.3 -> 6.0.3
5
vite 7.3.2 -> 8.0.16
6
vitest 4.1.4 -> 4.1.9
7
turbo 2.9.6 -> 2.9.18
8
@opennextjs/cloudflare 1.18.0 -> 1.19.11
9
wrangler 4.78.0 -> 4.100.0
10
ai 5.0.52 -> 6.0.208
11
@ai-sdk/openai 2.0.101 -> 3.0.74
1
$ mise exec -- pnpm audit --json > /tmp/assistance-pnpm-audit.json
2
exit: non-zero
3
4
metadata: low 31, moderate 137, high 91, critical 5, total dependencies 3526
1
$ mise exec -- pnpm audit --prod --json > /tmp/assistance-pnpm-audit-prod.json
2
exit: 1
3
4
metadata: low 23, moderate 109, high 64, critical 1

Representative production audit paths:

1
apps__academy>next
2
apps__studio>next
3
apps__blog>next
4
apps__academy>contentlayer2>@contentlayer2/utils>@opentelemetry/exporter-trace-otlp-grpc>@grpc/grpc-js>@grpc/proto-loader>protobufjs
5
apps__admin>axios
6
apps__docs>@mdx-js/loader>webpack>schema-utils>ajv>fast-uri
7
apps__blog>nuqs>react-router
8
apps__docs>react-use>js-cookie

Top high/critical advisory clusters from the full audit:

1
protobufjs: 1 critical, 5 high, 5 moderate
2
handlebars: 1 critical, 4 high, 2 moderate
3
form-data: 1 critical, 2 high
4
minimist: 1 critical, 1 moderate
5
shell-quote: 1 critical
6
next: 18 high, 11 moderate, 4 low
7
axios: 11 high, 9 moderate, 1 low
8
undici: 4 high, 3 moderate, 4 low
9
react-router: 3 high, 1 moderate, 1 low
10
vite: 2 high, 2 moderate
11
lodash.template: 2 high
12
fast-uri: 2 high
13
@grpc/grpc-js: 2 high

Assessment#

Yes, frontend/workspace dependencies need updates. The need is primarily security-driven, not just freshness-driven.

Urgent track: security triage and targeted patching#

The production audit still reports 1 critical and 64 high advisories. These should be triaged before broad routine upgrades.

Highest-priority areas:

  1. Next.js advisories across academy, studio, and blog.
    • The default catalog is on next 15.5.15; latest is 16.2.9.
    • Studio catalog pins next 16.2.3, also behind latest.
    • Do not jump all apps to Next 16 in one step. First determine whether patched Next 15 and patched Next 16 lines are available for each app/deploy target.
  2. Academy/contentlayer transitive protobuf stack (protobufjs, @grpc/grpc-js).
    • The production audit path is through contentlayer2/OpenTelemetry/grpc tooling.
    • This needs reachability review: if it is build-time only, isolate it from deployed artifacts; if runtime-reachable, patch immediately.
  3. Admin axios advisories.
    • apps/admin>axios carries multiple high advisories.
    • This is a likely narrow patch candidate if apps/admin is still maintained/deployed.
  4. Blog react-router via nuqs.
    • Audit reports RCE/DoS/open-redirect advisories through apps__blog>nuqs>react-router.
    • Validate whether the vulnerable code is bundled or only metadata/transitive, then update nuqs/related router dependency if possible.
  5. Docs fast-uri and js-cookie paths.
    • fast-uri comes through docs MDX/webpack tooling; likely build-time but still should be patched.
    • js-cookie through react-use may be runtime-relevant.

Routine track: low-risk patch/minor batches#

Good candidates for routine update PRs after security triage:

  • turbo 2.9.6 -> 2.9.18
  • vitest 4.1.4 -> 4.1.9
  • @vitest/* 4.1.4 -> 4.1.9
  • Radix UI patch updates (1.x/2.x patch lines)
  • @opennextjs/cloudflare 1.18.0 -> 1.19.11 after a focused Cloudflare build check
  • wrangler 4.78.0 -> 4.100.0 after confirming patched dependencies still apply

These should be batched by subsystem and verified with the narrow app/test/build surfaces rather than a single monorepo-wide lockfile churn.

Deferred major migrations#

Do not treat these as routine updates:

  • next 15 -> 16
  • react/react-dom 18 -> 19
  • typescript 5.9 -> 6.0
  • vite 7 -> 8
  • @vitejs/plugin-react 5 -> 6
  • ai 5 -> 6 and @ai-sdk/openai 2 -> 3

These affect multiple app runtimes, OpenNext/Cloudflare builds, package peer dependency ranges, and Studio-specific catalog constraints. They need dedicated migration plans and compatibility matrices.

Deprecated packages#

Deprecated entries should be cleaned opportunistically:

1
@types/markdown-table@3.0.0
2
mdast@3.0.0
3
@types/mdx-js__react@1.5.8
4
@types/react-datepicker@4.19.6
5
@types/react-grid-layout@1.3.6
6
@types/recharts@1.8.29
7
@types/uuid@8.3.4

Most are type packages or legacy MDX dependencies, so they are lower priority than the high/critical security advisories unless they block upgrades.

Recommendation#

Proceed with dependency updates, but in this order:

  1. Create a security-patch branch for high/critical pnpm audit findings. Start with Next patch-line options, axios, protobuf/grpc, react-router/nuqs, fast-uri, and js-cookie.
  2. Create a routine tooling patch branch for Turbo/Vitest/Radix/OpenNext/Wrangler patch-minor updates.
  3. Create separate major migration plans for Next 16, React 19, TypeScript 6, Vite 8, and AI SDK 6.
  4. Keep Studio catalog separate from the default catalog. Studio has its own pins and should not be swept into public-app dependency updates without Studio-specific verification.

Minimum verification for any frontend update branch:

1
mise exec -- pnpm install --lockfile-only
2
mise run typecheck
3
mise run test
4
mise run build:pick -- www,docs,blog
5
mise run perf:cf-budgets -- --app www --app docs --app blog --allow-missing

Adjust the verification set to the actual packages changed; do not claim the whole workspace is green from a narrow check.