Standard: Dependencies — upgrade aggressively

The mesh keeps its dependencies current. Apply updates promptly — including majors — and when an upgrade breaks something, fix it. Fixing an upgrade is cheaper than deferring it.

Canonical, project-agnostic standard (the version other repos copy). Pairs with supply-chain-hardening (Dependabot + vuln clearing) and the line-ending hygiene that keeps a post-upgrade formatter run from drowning the working tree in CRLF noise.

Why

• Deferral compounds. A skipped major becomes a painful big-bang migration later; staying current keeps each jump small and reviewable.
• Security + support. Current deps get security patches and upstream support; stale ones accrue silent risk and fall out of support windows.
• A real test suite makes majors a non-event. That's the whole point of the gate: a major bump becomes "run the gate, see what actually breaks," not a leap of faith. A live 3-major react-intl bump (7 → 10) landed with zero breakage behind a full gate — one line of reformat.

The practices (all mandatory)

1. Dependabot on, grouped minor/patch, weekly, targeting the working branch (dev) so update PRs match the git-flow instead of piling onto the default branch. See the dependabot.yml template.
2. A full, locally-runnable test gate — lint + unit + integration + build + (where they exist) E2E/visual + a perf/size budget. "Testable locally" is first-class: CI mirrors the local gate; it is not the first place a breakage is discovered.
3. Apply updates promptly. Merge Dependabot PRs on the regular cadence; periodically run a full ncu -u (or ecosystem equivalent) including majors and fix whatever the gate flags.
4. Fix, don't pin-and-forget. Deferring or pinning an upgrade is allowed only with a documented reason (e.g. a known-broken upstream release) and a revisit note — never as the silent default. Record it in the project's decisions/ or a # pinned: comment by the dependency.
5. Bump the version when an upgrade changes the shipped artifact (PATCH for a routine dep refresh), with the changelog entry riding in the same commit (versioning, git-workflow).

Verify (is it being followed?)

The per-standard slice the compliance audit aggregates — report done/partial/missing: