dependency-maintenance

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

Dependency maintenance

依赖项维护

Inspect

检查

Follow repository guidance. Read
```
package.json
```
, the lockfile, and
```
.npmrc
```
; preserve existing user changes.
Read relevant dated dependency decisions in the target project's
```
.agents/dependencies/
```
; the latest decision for each package supersedes earlier entries.
Use the project's package manager and pinned Node/npm versions. Check
```
npm outdated --json
```
and
```
npm audit --json
```
; a nonzero exit can indicate findings rather than a command failure.
For audit-only requests, report findings without editing files. For updates, stay within the requested packages or Dependabot change.

遵循仓库指南。读取
```
package.json
```
、lockfile 和
```
.npmrc
```
；保留用户现有的改动。
读取目标项目
```
.agents/dependencies/
```
中与日期相关的依赖项决策；每个包的最新决策取代较早的记录。
使用项目指定的包管理器和锁定的 Node/npm 版本。运行
```
npm outdated --json
```
和
```
npm audit --json
```
；非零退出码可能表示发现了问题，而不一定意味着命令执行失败。
对于仅要求审计的请求，只报告发现的问题，不编辑文件。对于更新请求，将改动范围限制在所请求的包或 Dependabot 变更内。

Update

更新

When scope is unspecified, prefer stable patch and minor updates in small coherent batches. Handle majors separately; consult official release notes and migration guides, check engines and peer dependencies, and implement migrations when requested.
Keep related packages compatible, especially Prisma client/adapter/CLI and Vitest/coverage/UI. Semver compatibility alone does not guarantee a harmless update.
Prefer targeted updates over updating everything to
```
latest
```
. Preserve version-range conventions and the lockfile; inspect the diff for unrelated changes.
For vulnerabilities, inspect the advisory and dependency path (
```
npm explain <package>
```
). Prefer updating the introducing dependency; use a narrow override only with a compatibility check and a recorded reason. Review existing overrides for removal when no longer needed.
Do not use
```
npm audit fix --force
```
or
```
--legacy-peer-deps
```
to bypass incompatibilities. Review newly required install scripts before changing permissions.
Investigate unused dependencies or bundle size only when relevant or requested. Confirm actual usage before removing a package, including Nuxt auto-imports, modules, configuration, and scripts.

当范围未指定时，优先以小而连贯的批次进行稳定的补丁版本和次版本更新。主版本更新应单独处理；查阅官方发布说明和迁移指南，检查 engines 和 peer dependencies，并按要求实施迁移。
保持相关包彼此兼容，尤其是 Prisma client/adapter/CLI 与 Vitest/coverage/UI。仅仅 Semver 兼容并不能保证更新无害。
优先进行有针对性的更新，而不是将所有包都更新到
```
latest
```
。保留版本范围约定和 lockfile；检查 diff 中是否包含无关改动。
对于漏洞，检查 advisory 和依赖路径（
```
npm explain <package>
```
）。优先更新引入该漏洞的依赖项；仅在进行兼容性检查并记录原因后，才使用范围尽可能窄的 override。检查现有 override，并在不再需要时将其移除。
不要使用
```
npm audit fix --force
```
或
```
--legacy-peer-deps
```
绕过不兼容问题。在更改权限之前，审查新引入的必需安装脚本。
仅在相关或明确要求时调查未使用的依赖项或 bundle size。移除包之前，确认其实际使用情况，包括 Nuxt auto-imports、modules、配置文件和脚本。

Validate and report

验证与报告

Follow the project's validation rules and run a production build when build or runtime dependencies change. Verify a lockfile-based clean install in an isolated environment when needed to check reproducibility.
If a batch fails, fix within scope or undo only your changes for that batch. Do not weaken checks; distinguish pre-existing failures from regressions.
Summarize versions changed, migrations, validation results, and unresolved vulnerabilities or deferred updates with reasons. State checks that could not run.
Dependabot handles recurring monitoring; do not add another scheduler or change its configuration unless requested.

遵循项目的验证规则；当构建依赖项或运行时依赖项发生变化时，运行生产构建。必要时在隔离环境中验证基于 lockfile 的全新安装，以确认可复现性。
如果某个批次失败，应在既定范围内修复，或仅撤销自己对该批次所做的改动。不得弱化检查；应区分原有失败与回归问题。
汇总已变更的版本、迁移、验证结果，以及未解决的漏洞或延后处理的更新，并说明原因。说明哪些检查无法运行。
Dependabot 负责持续监控；除非明确要求，不要添加额外的调度器，也不要更改其配置。

Decision record

决策记录

When changing overrides or deferring updates, use

.agents/dependencies/YYYY-MM-DD-topic.md

with today's date and a short topic in kebab-case, following the template. Update the existing file for the same date and topic; keep older records. Record decisions only, without a work log.

在更改 override 或延后更新时，使用
```
.agents/dependencies/YYYY-MM-DD-topic.md
```
，其中日期为今天，主题采用简短 kebab-case，并遵循模板。对于日期和主题相同的现有文件，更新该文件；保留较早的记录。仅记录决策，不写工作日志。