From 439fe59daa428e864d84a442ada5ec92f6f78ead Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 28 Jul 2026 00:19:39 +0200 Subject: [PATCH] docs: analyze dependency update blast radius --- context/deps-analysis.md | 48 ++++++++++++++++++++++++++++++++++++++++ 1 file changed, 48 insertions(+) create mode 100644 context/deps-analysis.md diff --git a/context/deps-analysis.md b/context/deps-analysis.md new file mode 100644 index 0000000..83cd756 --- /dev/null +++ b/context/deps-analysis.md @@ -0,0 +1,48 @@ +# Dependency update analysis + +Analysis only; no dependency versions were changed. Captured on 2026-07-27 with +Bun 1.3.8 against repo-map scan `a27e2c4` (2026-07-27). + +## Method + +- `bun outdated` reported eight outdated direct dependencies. Because the + manifest pins exact versions, its `Update` column matched `Current` for all + eight; the table below compares `Current` with `Latest`. +- `bun pm ls --all | head -100` confirmed the installed current versions and + showed the relevant packages in the local dependency tree. A focused + `bun pm why` check additionally confirmed that + `conventional-commits-parser` is used transitively by + `conventional-recommended-bump`. +- `npx madge --extensions ts src --json` produced 27 modules and 66 internal + edges. External npm imports are not represented in that default Madge JSON, + so direct package consumers were verified from source imports and their + transitive `src` consumers were calculated by walking the Madge graph + backwards. +- The repo map marks both direct-consumer zones as high fan-out: + `src/commands` has Ce=38 and `src/lib` has Ce=17. Its warning that static + analysis cannot see runtime/dynamic wiring applies here, especially to the + dynamically loaded conventional-changelog preset. + +## Findings + +| package | current -> latest | major? | imported by | risk | recommendation | +| --- | --- | --- | --- | --- | --- | +| `@clack/prompts` | `0.9.1 -> 1.7.0` | yes (`0 -> 1`) | Direct: `src/commands/auth.ts`, `src/lib/conflict-prompt.ts`, `src/lib/tool-prompt.ts`. Transitive reverse closure: `src/commands/get.ts`, `src/commands/sync.ts`, `src/index.ts`. | **High.** Runtime interactive UX crosses both mapped high-fan-out zones and covers authentication, tool selection, orphan warnings, and conflict resolution. Tests also mock the package API, so API or cancellation-semantics changes can affect production and test seams together. | **human decision** — review the 1.x API/migration notes and validate every TTY/non-TTY prompt flow in a dedicated change. | +| `@types/bun` | `1.3.12 -> 1.3.14` | no | No direct or transitive package import in `src`; loaded ambiently for the full TypeScript program by `tsconfig.json` (`types: ["node", "bun"]`). No Bun-specific symbol is referenced in `src` (tests do import `bun:test`). | **Low.** Patch-level, type-only change with no runtime edge. Ambient declaration changes can still surface anywhere during strict typechecking. | Candidate for a later isolated patch iteration; require typecheck and the differential test gate. | +| `@types/node` | `22.19.17 -> 26.1.2` | yes (`22 -> 26`) | No literal `@types/node` import; it is ambient via `tsconfig.json`. Direct Node built-in/global API consumers include `src/index.ts`, `src/commands/{doctor,get,sync}.ts`, and `src/lib/{api-client,api-content,auth-flow,auth-guard,config,conflict-prompt,fs-utils,manifest,output,signing,tool-detect,tool-prompt,tool-switch,update-check,writer}.ts`; their graph closure reaches every CLI command through `src/index.ts`. | **High.** Ambient declarations affect nearly the whole strict TypeScript program, while the package still declares runtime support as Node `>=20`; adopting Node 26 declarations could accidentally permit APIs unavailable on older supported runtimes. | **human decision** — align the declaration major with the supported Node/Bun runtime matrix before considering an isolated migration. | +| `conventional-changelog-angular` | `8.3.1 -> 9.2.1` | yes (`8 -> 9`) | No `src` import. Runtime-loaded by `scripts/auto-version.mjs` through `Bumper.loadPreset("angular")`. | **Medium.** Production CLI code is untouched, but preset behavior can change automated release classification and therefore published versions. The dynamic load is invisible to Madge. | **human decision** — evaluate together with the release-versioning stack and exercise representative commit histories before changing it. | +| `conventional-commits-parser` | `6.4.0 -> 7.1.1` | yes (`6 -> 7`) | No `src` import. No direct repository import was found; `bun pm why` shows it is a transitive dependency of `conventional-recommended-bump`, so `scripts/auto-version.mjs` reaches it indirectly. | **Medium.** Release-only blast radius, but parse changes can alter which commits feed the automated bump recommendation. The manifest also pins it directly, so dependency deduplication/compatibility must be reviewed with the other release packages. | **human decision** — assess as part of one coordinated release-tooling decision, not as an independent source dependency. | +| `conventional-recommended-bump` | `11.2.0 -> 12.1.0` | yes (`11 -> 12`) | No `src` import. Directly imported by `scripts/auto-version.mjs`; it also brings `conventional-commits-parser` transitively. | **High for releases, none for CLI runtime.** This script selects major/minor/patch and is invoked by the release workflow, so behavior drift can produce an incorrect published version even though the `src` graph is unaffected. | **human decision** — review the major migration with both conventional-changelog packages and test no-bump, patch, minor, and breaking-change histories. | +| `oxlint` | `0.16.12 -> 1.76.0` | yes (`0 -> 1`) | No `src` import. Invoked by the `lint` package script and by `tools/examples-catalog/build.mjs`. | **Medium.** Tool-only, but it is a CI gate over the repository and an examples-catalog gate. A large version jump can change rule defaults, diagnostics, or configuration behavior; the pinned baseline is two deliberate warnings. | **human decision** — trial in a dedicated lint-tooling change and compare diagnostics/config semantics against the pinned warning baseline. | +| `typescript` | `5.9.3 -> 7.0.2` | yes (`5 -> 7`) | No runtime `src` import. It compiles the entire `tsconfig.json` program (`src`, `scripts`, and `tests`) through `bun run typecheck`. | **High.** Two compiler majors affect every source module and strict/bundler-mode semantics, and type declaration compatibility must be considered with both `@types/node` and `@types/bun`. | **human decision** — plan as a compiler migration, review breaking changes for both majors, and keep it separate from ambient-type upgrades unless compatibility requires coordination. | + +## Caveats + +- “No `src` import” means no static source-package edge, not no repository + impact. Type packages are ambient, while lint/compiler/release packages act + through scripts and CI. +- The reverse closure is limited to static imports. Dynamic imports, generated + code interactions, executable/package resolution, and behavior changes + internal to dependencies remain unknown until a dedicated update is tested. +- Major versions are recommendations for human review only. This report does + not authorize or perform any package, manifest, or lockfile change.