Dependency Updates

Use the built-in dependency update action to update Go and npm dependencies from a workflow stage and persist structured output for later stages.

What it does

The dependency_updates on-enter action discovers supported dependency manifests in the agent workspace, runs ecosystem-native package manager commands, and stores structured JSON output as a pipeline output.

The action updates files in the working tree only. It does not run tests, commit changes, or open a PR. Use later workflow stages to validate, fix, commit, and create the PR.

Basic stage

yaml

stages:
  - id: update_dependencies
    label: Update Dependencies
    entry: true
    on_enter:
      dependency_updates:
        ecosystems: [go, npm]
        paths: ["."]
        output: dependency_updates
        timeout: 30m
      inject: |
        Dependency updates were applied.

        Review {{ .Outputs.dependency_updates.files_changed }}.
        Run the test suite, fix any failures, and open one grouped PR.
        Say [DONE] when the PR is open or no changes are needed.

The default output name is dependency_updates, so later stage templates can reference values with {{ .Outputs.dependency_updates.<field> }}.

Supported ecosystems

go - Detects go.mod and go.sum. Runs go list -m -u -json all, applies selected updates with go get module@version, and runs go mod tidywhen updates are applied.

npm - Detects package.json with package-lock.json or npm-shrinkwrap.json. Runs npm outdated --json and npm update --package-lock-only package for selected updates.

Configuration

yaml

on_enter:
  dependency_updates:
    ecosystems:
      - go
      - npm
    paths:
      - "."
    grouping: all
    include_major: false
    separate_major: true
    separate_security: true
    separate_runtime: true
    allow:
      - "*"
    ignore:
      - "example-package"
    output: dependency_updates
    timeout: 30m
    continue_on_error: false

ecosystems - List of package ecosystems to update. Defaults to auto, which currently enables Go and npm.

paths - Workspace-relative paths to scan. Defaults to ..

grouping - Metadata for later PR stages. The first implementation emits grouped update metadata with all as the default.

include_major - Defaults to false. Major updates are reported as skipped instead of being applied.

separate_major, separate_security, and separate_runtime - Metadata controls for later PR grouping stages. All three default to true; the dependency update action records grouping metadata, and later stages decide how to split or combine PRs.

allow and ignore - Glob-style package filters. Defaults to allowing all packages.

output - Pipeline output name. Defaults to dependency_updates.

timeout - Go-style duration. Defaults to 30m.

Structured output

The action writes JSON to stdout and ElasticClaw persists it as a pipeline output.

json

{
  "ecosystems": ["go", "npm"],
  "manifests": [
    {
      "ecosystem": "go",
      "path": "go.mod",
      "lockfiles": ["go.sum"]
    },
    {
      "ecosystem": "npm",
      "path": "web/package.json",
      "lockfiles": ["web/package-lock.json"]
    }
  ],
  "updates": [
    {
      "ecosystem": "go",
      "name": "github.com/example/module",
      "from": "v1.2.3",
      "to": "v1.3.0",
      "type": "minor",
      "applied": true,
      "group": "default"
    },
    {
      "ecosystem": "npm",
      "name": "example-package",
      "from": "2.4.0",
      "to": "3.0.0",
      "type": "major",
      "applied": false,
      "group": "major",
      "skipped_reason": "major updates disabled"
    }
  ],
  "commands": [
    {
      "command": "npm outdated --json",
      "cwd": "web",
      "exit_code": 1
    }
  ],
  "files_changed": [
    "go.mod",
    "go.sum",
    "web/package-lock.json"
  ]
}

Cron workflow example

yaml

schema_version: v1
name: dependency-maintenance
enabled: true

trigger:
  cron:
    schedule: "0 9 * * 1"
    timezone: "America/Chicago"
    overlap_policy: skip

provider: daytona
tags: ["dependencies"]

stages:
  - id: update_dependencies
    label: Update Dependencies
    entry: true
    on_enter:
      dependency_updates:
        ecosystems: [go, npm]
        include_major: false
        output: dependency_updates
      inject: |
        Dependency update metadata:
        {{ .Outputs.dependency_updates.files_changed }}

        Run tests. If tests pass and files changed, open one grouped PR.
        If tests fail, fix the failures or explain why the update should be skipped.
        Say [DONE] when finished.

  - id: complete
    label: Complete
    triggers:
      - message_contains: "[DONE]"
    terminal: true

Failure behavior

The stage fails when required package manager tooling is missing or a native command exits with an unexpected non-zero status. The partial JSON output still includes commands that ran and any manifests found before failure when possible.

Set continue_on_error: true when you want the agent to inspect partial output and try to recover in the same stage.