Dependency Update Agent

Continuously scan for outdated npm packages, security vulnerabilities, and breaking changes. Automatically propose PRs with upgrade paths and risk summaries.

Keeping dependencies up to date is critical for security and stability, yet it's tedious to track manually. Security advisories, new major versions, and transitive dependency updates pile up fast.

A dependency update agent monitors your package registry, detects vulnerabilities and outdated packages, evaluates upgrade safety, and opens PRs with clear risk assessments.

What the agent does

On a weekly schedule, the dependency agent:

Scans dependencies — runs npm audit, yarn audit, or pnpm audit to find vulnerabilities and outdated packages
Filters by risk — separates patch/minor updates from major versions that might break things
Evaluates breaking changes — checks changelogs and GitHub releases for breaking changes
Tests upgrades — runs your test suite against the updated dependencies
Proposes PRs — creates grouped PRs (one for routine updates, one for security, one per major bump) with risk summaries
Tracks risk scores — includes CVE severity, adoption rate, and release stability in the PR description

Set it up

Prerequisites

AACWorkflow workspace with an active agent
npm, yarn, or pnpm configured in your repo
CI/CD pipeline that runs tests (GitHub Actions, Buildkite, etc.)

Step 1: Create the dependency update agent

Go to Settings → Agents and click New Agent
Choose your runtime and provider
Name it dependency-bot or upgrade-manager
Add this system prompt:

Role: Dependency update manager
Task: Weekly or on-demand:
1. Run npm/yarn/pnpm audit to find vulnerabilities and outdated packages
2. Separate findings:
   - Critical/high CVEs → immediate branch
   - Patch & minor updates → routine maintenance branch
   - Major version updates → per-package branches (evaluate breaking changes)
3. For each major update:
   - Check GitHub releases for breaking changes
   - Run full test suite with updated version
   - Report pass/fail and any deprecation warnings
4. Create GitHub branches and PRs grouped by risk tier
5. Add detailed PR description with:
   - Vulnerability CVE-IDs and severity (CVSS score if available)
   - Changelog highlights
   - Test results summary
   - "⚠️ This is a major version bump" flag for breaking updates

Example PR title format:
- "deps: security updates (npm audit)" → patch updates, no breaks
- "deps: urgent | CVE-2025-1234 (critical)" → security hot-fix
- "deps: major | react@19 + breaking changes" → major version bump

5. Auto-request code review from team (post in Slack/Teams)
6. Link PRs to AACWorkflow issues for tracking

Step 2: Schedule the agent

Go to Settings → Automations and create a scheduled task:

Trigger: Weekly (e.g., Thursday 10 AM)
Task: Assign to dependency-bot agent
Template: dependency-update

Or use a cron job:

# Every Thursday at 10 AM
0 10 * * 4 curl -X POST https://aacworkflow.com/api/tasks \
  -H "Authorization: Bearer $TOKEN" \
  -d '{"agent_id": "dependency-bot", "title": "Weekly dependency scan"}'

Step 3: Configure audit rules

Add .aacworkflow/dependency-config.yml:

dependency_audit:
  package_managers:
    - npm
    - pnpm
  auto_merge:
    enabled: true
    conditions:
      - type: patch
        only_if: all_tests_pass
      - type: minor
        only_if: all_tests_pass_and_no_deprecation_warnings
      - type: major
        only_if: manual_approval
  
  skip_packages:
    - react       # pin in package.json, don't auto-update
    - react-dom
    - expo        # mobile pinned
  
  priority:
    critical_cve: "auto-merge if tests pass"
    high_cve: "create PR, notify team"
    medium_cve: "batch with weekly update"
    patches: "batch with weekly update"

  notification:
    slack_channel: "#dependencies"
    mention_on_critical: "@security-team"

Example PR outputs

Routine update (patch + minor)

Title: deps: routine updates (3 packages)

Body:

## Changes

- chalk 5.3.0 → 5.4.1 (patch)
- lodash-es 4.17.21 → 4.18.0 (minor)
- ts-node 10.9.1 → 10.9.2 (patch)

All changes are backwards compatible. Tests: ✅ PASS (1200 tests in 42s)

---
**Risk:** Low | No deprecation warnings | Routine maintenance
Merging this is safe.

Security update (high CVE)

Title: deps: urgent | CVE-2025-1234 (high) in express

Body:

## Vulnerability

**express 4.18.0 → 4.19.5** (patch)

⚠️ **CVE-2025-1234** — Request header parsing DoS
- CVSS Score: 7.5 (High)
- Affected: express < 4.19.5
- Fix: Backport in patch release

https://nvd.nist.gov/vuln/detail/CVE-2025-1234

## Action

This is a security patch with no breaking changes.

Tests: ✅ PASS (1200 tests in 40s)
No deprecation warnings.

---
**Risk:** Low (security patch only)
✅ Safe to merge immediately. Recommend merging today.

Major version update (breaking change)

Title: deps: major | typescript@5.6 (from 5.5)

Body:

## Breaking Changes

**typescript 5.5.4 → 5.6.0** (major)

### Highlights
- Stricter null checking (new flag)
- Removed deprecated `ts.transpileOnly` option
- New `verbatimModuleSyntax` requirement for type imports

### Migration Required

Files needing updates:
- `tsconfig.json`: set `verbatimModuleSyntax: true`
- 3 files with bare `import type` → add `type` keyword

## Test Results

Typecheck: ⚠️ 12 errors (migration required) Unit tests: ⛔ FAIL (due to typecheck failures) E2E: ⛔ SKIP (blocked by typecheck)


This PR is in **DRAFT** mode. Required steps to merge:
1. Fix tsconfig.json
2. Update import statements
3. Re-run tests (target: all green)
4. Get code review from @backend-lead

---
**Risk:** Medium | Requires migration | Recommend 1–2 day sprint

Tips & best practices

Separate by risk. Group routine patches, batch security updates, and treat major versions as separate projects. Don't overwhelm your team with a single 50-file PR.

Test before proposing — run your full test suite against updated deps; only open PRs if tests pass or failures are clearly pre-existing
Transitive deps — use npm audit fix --audit-level=moderate to apply safe transitive dependency updates automatically
Lock file strategy — commit lock files; run tests before merging to catch subtle breaking changes
Security first — if a critical CVE exists, open a PR same-day; don't batch with routine updates
Deprecation warnings — capture npm list deprecation output in the PR; plan removal timelines
Team notifications — post high-severity PRs in Slack/Teams immediately; don't wait for weekly digest

CI Triage Agent — if a dependency update breaks tests, the CI agent will help triage
Release Notes Agent — include dependency updates in your release notes

On this page