dependency-update-reviewlisted

# Dependency Update Review ## Goal Assess dependency and lockfile changes for compatibility, supply-chain risk, package-manager consistency, and targeted validation needs. ## When to use - A PR updates dependencies or lockfiles. - The user asks whether an upgrade is safe. - Package manager, runtime version, or dependency policy changes need review. ## When not to use - The task is broad security hygiene; use `security-baseline-review`. - The user asks for a full PR review with dependency changes as one part; use `pr-review`. - Current vulnerability status is required but advisory data is unavailable. ## Inputs to inspect - Manifest files, lockfiles, package-manager config, and runtime version files. - Changelogs or release notes for direct dependency major updates. - CI results, test coverage, and code paths using upgraded packages. ## Review rubric Check direct vs transitive changes, major version jumps, package manager consistency, postinstall scripts, binary/native dependencies, lockfile churn, and targeted test coverage. Read `references/dependency-risk-rubric.md` for detail. ## Workflow 1. Identify the package manager and changed dependency files. 2. Separate direct dependency updates from transitive lockfile changes. 3. Flag major upgrades and packages with build, native, auth, or network behavior. 4. Check whether docs, config, or code need migration updates. 5. Recommend targeted validation commands. 6. Do not claim vulnerability status without current adv