Dependency updates

Goal and eligibility

Dependency updates select at most one dependency root cause from the current repository and prepare an issue or reviewable update. The runbook can discover candidates from manifests, lockfiles, package-manager metadata, safe native audit output, and current provider state; it does not require a prior shared audit handoff.

Candidate selection

A candidate needs an installed or resolved version, an exact safe target or fixed range, dependency scope and directness, a bounded update mechanism, and useful verification. Guard prefers the highest-value safe root cause, not the package that is mechanically easiest to change. It rejects unconstrained latest, major framework or runtime migrations, package-manager changes, and broad update commands.

Only one root cause is selected. Existing issues and review requests are searched before any provider write so an update already under review is reused rather than duplicated.

Bounded change

Issue-only mode leaves manifests and lockfiles untouched. In issue-plus-review-request mode, the diff may change only the dependency source needed for the selected root cause. It must avoid unrelated lockfile churn and cannot modify application code, tests, docs, CI, formatting, or generated application code to accommodate the update.

Guard never uses force-update commands, pushes directly to the default branch, or merges the review request.

Verification

Verification starts with the relevant package-manager integrity or lockfile check and continues with repository-native commands that were usable before the edit. The run records each command, result, and limitation. If the target version cannot be proven safe, the diff expands, unrelated packages move, or credible verification is unavailable, no autonomous PR/MR is opened.

Outcomes and rerun

The result can be an issue, issue plus review request, no safe candidate, already covered work, package-manager blocked, verification failed, needs human review, or report-only output. After a human merges the update, rerun Dependency hygiene and the relevant repository tests to verify the acquisition path and original risk.