Dependabot Resolution Workflow

Execute a comprehensive dependency update workflow:

Step 1: Analyze Dependabot Issues

• •Use gh issue list --label "dependencies" --state open --json number,title,url,body to list all open Dependabot issues
• •For each issue, carefully analyze:
  • •What dependency is being updated
  • •What version change is proposed (patch/minor/major)
  • •Any breaking changes mentioned
  • •Security vulnerabilities fixed
• •Determine which updates should be applied based on:
  • •Security fixes (high priority)
  • •Patch updates (generally safe)
  • •Minor updates (review carefully)
  • •Major updates (review very carefully for breaking changes)

Step 2: Run Security Audit

• •Run pnpm audit to check for security vulnerabilities
• •Identify any critical or high-severity issues
• •Note any recommended updates from the audit

Step 3: Create Update Branch

If there are updates to apply:

• •Get current date in MMDD format (e.g., "1220" for December 20th)
• •Get the current branch name to use as base
• •Create new branch: deps-update-MMDD from the current branch
• •Switch to the new branch

Step 4: Apply Updates

• •For each dependency to update:
  • •Use pnpm update <package-name> or pnpm add <package-name>@<version> as appropriate
  • •If it's a major version update, check for breaking changes in the changelog first
• •After all updates, run pnpm install to ensure lockfile is updated

Step 4.5: Handle Related Updates (Package + Infrastructure Sync)

Some packages require coordinated updates across multiple files. Check for these patterns:

Playwright Package + Docker Image

When updating @playwright/test or playwright in package.json:

1. •

   Check current versions:

   • •package.json: Look for @playwright/test and playwright versions
   • •.github/workflows/*.yml: Search for mcr.microsoft.com/playwright:v Docker image tags
2. •

   Update Docker image tag to match the npm package version:

   yaml

   # In workflow files using Playwright Docker container
   container:
     image: mcr.microsoft.com/playwright:v<NEW_VERSION>-noble
   

3. •

   Verify image exists at https://mcr.microsoft.com/v2/playwright/tags/list or check Microsoft's Playwright Docker documentation

4. •

   Example: If updating @playwright/test from 1.57.0 to 1.58.0:

   • •Update package.json: "@playwright/test": "^1.58.0"
   • •Update workflow: image: mcr.microsoft.com/playwright:v1.58.0-noble

Other Common Pairs to Watch

• •TypeScript + @types packages: May need coordinated updates
• •ESLint + plugins: Plugin versions often need to match ESLint major version
• •Next.js + related packages: next, eslint-config-next, etc.

Step 5: Quality Checks

Run all quality checks in sequence:

1. •Type checking: pnpm typecheck
2. •Linting: pnpm lint (or pnpm lint:fix if auto-fixable)
3. •Formatting: pnpm format (or pnpm format:fix if needed)
4. •Unit tests: pnpm test:unit
5. •Build: pnpm build (to ensure the project builds successfully)
6. •E2E tests: pnpm test:e2e:critical or pnpm test:e2e:full-prod for comprehensive testing

Step 6: Review Results

• •If all checks pass:
  • •Proceed to Step 7
• •If any checks fail:
  • •Investigate the failure
  • •Determine if it's a breaking change or test needs updating
  • •Fix issues or revert problematic updates
  • •Re-run quality checks

Step 7: Push and Create PR

Once all checks pass:

• •Stage all changes: git add .
• •Commit with descriptive message: git commit -m "chore: Update dependencies (MMDD)"
• •Push to remote: git push -u origin deps-update-MMDD
• •Create PR using gh pr create with:
  • •Title: "chore: Update dependencies (MMDD)"
  • •Body including:
    • •List of updated packages and versions
    • •Summary of security fixes (if any)
    • •Links to Dependabot issues being resolved using list format:
      code

      - 関連Issue
          - https://github.com/<owner>/<repo>/issues/<issue-1>
          - https://github.com/<owner>/<repo>/issues/<issue-2>
      

    • •Note that all quality checks passed
  • •Use full URLs (not #<number>) so GitHub auto-expands them to show issue titles

Important Notes

• •Never auto-merge - always create PR for manual review
• •For major version updates, mention breaking changes in PR description
• •If updating critical dependencies (Gatsby, React, etc.), note that extra testing may be needed
• •Close related Dependabot issues after PR is merged
• •Follow the project's dependency management guidelines from CLAUDE.md

Safety Checks

• •Never use --force flags
• •Always run full test suite before pushing
• •Check for deprecation warnings during build
• •Verify the build output works correctly (pnpm serve and manual testing if needed)