How to update packages in an AI-built app without breaking it

A package is code that other people wrote and that your app uses. AI tools add many packages to an app. Packages control parts of the app, such as pages, sign-in and payments.

People find security problems in packages. The package authors then release new versions. If you do not update a package, your app keeps the known problem.

Most packages use three numbers, for example 2.4.1. The number that changes tells you the type of update.

• Patch (2.4.1 to 2.4.2): The update repairs a problem. The risk is low.
• Minor (2.4.1 to 2.5.0): The update adds new functions. The risk is low.
• Major (2.4.1 to 3.0.0): The update can change how the package operates. Your code can need changes. The risk is high.

People choose these numbers, so a small update can also cause a problem. Always test an update.

1. Make sure that the code of your app is on GitHub.
2. Make sure that the app has no errors before you start. If the app has errors now, you cannot find the cause of new errors.
3. Write a list of the main tasks that users do in your app. For example, sign in, add a record and pay.
4. Make a new branch. A branch is a separate copy of the code. Changes on a branch do not change the live app.

1. Update packages that have a known security problem.
2. Update patch and minor versions in small groups of related packages.
3. Update major versions last, one package at a time. Read the release notes of the package first.

These commands are for projects that use npm. Projects that use pnpm or Yarn have similar commands.

1. Open a terminal in the folder of your project.
2. Type npm outdated to see the old packages.
3. Type npm audit to see the packages that have known security problems.
4. Type npm audit fix --dry-run to see the proposed changes. This command does not change your project.
5. Type npm install [email protected] to update one package. Use the correct name and version.
6. Type npm run build and make sure that the build has no errors.
7. Type npm test if your app has tests.
8. Start the app and do each task on your list.
9. Save the change as a commit and send the branch to GitHub.
10. Open a pull request and merge the pull request. Read how to read and merge a pull request.

The file package-lock.json records the exact version of each package. Include this file in each commit. Do not delete this file to remove an error.

1. Stop. Do not add more updates.
2. Read the first error in the build output. The first error is usually the cause of the other errors.
3. Install the previous version of the last package that you updated.
4. Build and test the app again.
5. Read the release notes of that package. Find the section about breaking changes.
6. Make the changes that the release notes tell you to make.

If the bad update is already live, use the Revert button on GitHub. This button makes a new pull request that removes the change.

If the old version has a known security problem and you cannot repair the error, get help from a developer.

Do not tell an AI tool to update all packages. That instruction makes many changes at one time. If the result has errors, you cannot find the cause. Give the AI tool one package or one small group.

GitHub Dependabot can find old packages and send updates as pull requests. Dependabot does not test your app. If your repository has no automatic tests, do each task on your list before you merge.