Dependency upgrades

Overview

Module	craft.15 · practice · docs · Pass 11 · 1 to 2 h
You build	docs/maintenance/dependency-upgrades.md
Tests	course/tests/craft.15 (named below, with why each exists)
Needs	none
Used by	no code call site; this is an independent artifact
Milestone	MS-P11

Key Takeaways

• Tie each claim to the exact platform evidence that Dependency upgrades produces.
• State the owner, success condition, and recovery action before declaring the work complete.
• Record unresolved assumptions so the next review can test them.

How to work this chapter

ol start craft.15
ol tests craft.15
ol check craft.15

---

1. Why now

Dependency changes can alter APIs, performance, and security properties at once. A deliberate upgrade isolates the cause and leaves a reversible path.

2. Principles

Read release notes and compatibility ranges before changing a major version. Upgrade one dependency family at a time, pin the resolved graph, and run behavior, race, security, and performance checks relevant to its use.

3. Worked example

For a breaking Go or Rust library update, first make a minimal branch that builds against the new API, then run contract suites and compare benchmark distributions to the recorded baseline. Keep the prior lockfile available.

4. The artifact and its check

Test	KIND	Checks	Why it matters downstream
test_artifact_paths_are_declared	artifact	Confirms the submitted paths and required evidence exist, so a plausible narrative cannot pass without the reviewable deliverable.

5. Pitfalls

#	Pitfall	Symptom	Caught by
1	The artifact names a decision without the evidence that supports it	Reviewers cannot verify the claim against the repository or system.	test_artifact_paths_are_declared
2	The failure or rollback case is omitted	The happy path passes while an operator has no safe response under failure.	test_artifact_paths_are_declared
3	The owner, threshold, or scope is implicit	Two reviewers can reach different release or risk decisions from the same evidence.	test_artifact_paths_are_declared

6. Where it’s used next

Direction	Module	Connection
Back	craft.02	Read this declared prerequisite before producing the artifact; use it to verify the relevant contract or evidence.
Back	ops.06	Read this declared prerequisite before producing the artifact; use it to verify the relevant contract or evidence.

Going further

Resource	What to inspect
C4 model and architecture rules, section 2.3	Compare the submitted views with the course system boundary and its process/file interfaces.