Website Dependencies and Libraries Update

Website Dependencies and Libraries Update

Outdated dependencies — source of vulnerabilities and technical debt. Can't postpone updates until "accumulated" because larger version gap means more complex and risky upgrade.

Update strategy

Patch versions (1.2.3 → 1.2.4) — automatically via Dependabot/Renovate, no manual testing needed.

Minor versions (1.2.x → 1.3.0) — automatically with manual CHANGELOG check for breaking changes.

Major versions (1.x → 2.0) — separate task with full testing, often requires code changes.

npm/Node.js: audit and update

# Audit vulnerabilities
npm audit
npm audit --audit-level=high  # high/critical only

# Auto-fix minor vulnerabilities
npm audit fix

# List outdated packages
npm outdated

# Update single package
npm update react react-dom

# Update to next major version
npx npm-check-updates -u  # updates package.json
npm install               # installs updated versions

PHP/Composer: update

# List outdated packages
composer outdated

# Update within constraints in composer.json
composer update

# Update specific package
composer update laravel/framework

# Vulnerability check
composer audit

Python/pip: update

pip list --outdated
pip install --upgrade package-name
pip-audit  # CVE check

Dependabot: automation

# .github/dependabot.yml
version: 2
updates:
  - package-ecosystem: npm
    directory: /
    schedule:
      interval: weekly
      day: monday
    groups:
      production-dependencies:
        dependency-type: production
        update-types: [minor, patch]
    open-pull-requests-limit: 5

  - package-ecosystem: composer
    directory: /
    schedule:
      interval: weekly
    open-pull-requests-limit: 3

Testing after update

# Full check cycle
npm run build       # any build errors
npm run lint        # new warnings
npm run test        # all tests green
npm run test:e2e    # key user scenarios

Major versions: required changes examples

React 17 → 18:

• ReactDOM.render → createRoot
• Changes in useEffect with Concurrent Mode
• Strict Mode now mounts components twice in dev

Next.js 13 → 14:

• Pages Router → App Router (if migrating)
• getServerSideProps → async Server Components
• New metadata conventions

Node.js 18 → 20:

• crypto API changes
• New built-in fetch (may conflict with node-fetch)

Update schedule

Monthly maintenance of average project dependencies — 4–8 hours.