Operations · Guide
Update dependencies with business tests, not hope
An AI-built application needs a maintainable update path after its first delivery.
Generated code still has dependencies
An illustrative request app uses a document parser, authentication library, and workflow client that were selected during rapid prototyping. Months later, an update changes parsing behavior. Inventory direct and transitive dependencies and identify which business paths they influence. GitHub’s dependency graph can help reveal relationships, but the customer’s risk assessment still needs to connect a package to actual data access and workflow consequences.
Build a small update matrix
For each dependency group, record an owner, update cadence, test fixture, and recovery route. A parser needs representative documents; an authorization component needs denied-access cases; a queue client needs duplicate and timeout tests. Keep a lock file and reproducible build process. Separate emergency security remediation from routine modernization so urgency is visible rather than every update being labeled both critical and optional.
Workflow at a glance
Compare behavior, not only compilation
Run the same synthetic business examples before and after an update. Compare extracted fields, permission outcomes, action counts, and recovery behavior. A test that merely imports the package will not detect a duplicate invoice or a changed date interpretation. For AI-related libraries, preserve the model configuration during the comparison where possible; otherwise attribution becomes ambiguous when several layers change together.
Make maintenance commercial scope
The handover should state who watches advisories, who approves disruptive updates, and which support agreement includes remediation work. A dependency inventory is not a promise that every vulnerability is exploitable, nor that a scanner finds everything. Use the inventory to prioritize investigation and communicate exposure. A small application can remain economical when update responsibilities are bounded instead of being forgotten until an emergency.
Preserve the reason for deferral
When compatibility requires a delay, record the owner, exposure assessment, compensating measures, and review date. A temporary deferral is a tracked obligation, not an ignored alert. This makes the decision explainable without pretending every advisory can be fixed instantly and safely by an automated update.
Sources and further reading
- Dependency graphDependency graphGitHub · Documentation ·
- Build secretsBuild secretsDocker · Documentation ·
Editorial approach
AI-assisted original writing, checked against linked public sources. Practical recommendations and illustrative scenarios are editorial analysis, not reported client results. Source dates and product details may differ from this collection’s preparation date.