How to Update Dependencies in the Open-SEO Project: A Complete Guide

Use pnpm outdated to inspect and pnpm up -L to upgrade dependencies across the TypeScript monorepo, then verify stability with the linting and test suite.

Open-SEO is a TypeScript monorepo managed with pnpm workspaces that contains a root package.json plus separate configurations for the web and badseo sub-packages. Keeping dependencies current requires using pnpm’s workspace-aware commands to ensure all lockfiles stay in sync.

Prerequisites: Install the Correct pnpm Version

The project pins pnpm version 10.30.1 in the root package.json via the packageManager field. Before updating dependencies, ensure your global installation matches:

npm i -g pnpm@10.30.1

Using the specified version guarantees compatibility with the workspace lockfiles located at pnpm-lock.yaml, web/pnpm-lock.yaml, and badseo/pnpm-lock.yaml.

Inspecting Outdated Dependencies

Run the inspection command from the repository root. pnpm automatically traverses all workspaces and reports current versus latest versions:

pnpm outdated

This scans the root package.json, web/package.json, and badseo/package.json to identify available upgrades.

Upgrading Dependencies

Open-SEO supports three primary upgrade strategies depending on your risk tolerance.

Bulk Upgrade to Latest

To update all packages to their latest compatible semver ranges in every workspace:

pnpm up -L

The -L flag respects ^ and ~ ranges while bumping to the newest available version. This rewrites all three pnpm-lock.yaml files automatically.

Interactive Selection

For controlled, package-by-package updates:

pnpm up -i

This prompts you to select specific upgrades for each workspace, preventing accidental major-version breaks.

Selective Package Updates

To target only specific libraries (e.g., updating @tanstack/react-query in the web workspace):

pnpm up @tanstack/react-query

You may specify multiple packages separated by spaces.

Verifying Dependency Updates

After modifying dependencies, validate the changes against the project’s quality gates:

pnpm run lint        # Runs oxlint with type awareness

pnpm run test        # Executes Vitest unit tests

pnpm run test:e2e    # Runs Playwright end-to-end tests

Finally, trigger a production build to regenerate TypeScript declarations and confirm type safety:

pnpm run build

Committing the Changes

Lockfiles are source-controlled and must be included in your commit. Run:

git add .
git commit -m "chore(deps): upgrade dependencies to latest versions"

Include the updated pnpm-lock.yaml files from the root, web/, and badseo/ directories to ensure reproducible installs across environments.

Summary

• Open-SEO uses pnpm 10.30.1 as its package manager across a monorepo containing web and badseo workspaces.
• Run pnpm outdated to inspect available updates across all package.json files.
• Use pnpm up -L for bulk upgrades, pnpm up -i for interactive selection, or pnpm up <package> for targeted updates.
• Always commit the modified pnpm-lock.yaml files in the root and workspace directories.
• Verify updates by running pnpm run lint, pnpm run test, and pnpm run build before deploying.

Frequently Asked Questions

What package manager does the open-seo project use?

The open-seo project uses pnpm version 10.30.1, specified in the packageManager field of the root package.json. This ensures consistent behavior across the monorepo’s root, web, and badseo workspaces.

How do I update only specific packages in the open-seo project?

Run pnpm up <package-name> from the repository root, replacing <package-name> with the dependency you want to bump. To update multiple specific packages, separate them with spaces (e.g., pnpm up react react-dom).

Should I commit the lockfiles after updating dependencies?

Yes. The pnpm-lock.yaml files in the root, web/, and badseo/ directories must be committed alongside your package.json changes. These lockfiles record exact resolved versions and are essential for reproducible builds in CI/CD pipelines.

What tests should I run after updating open-seo dependencies?

Run the full quality gate: pnpm run lint (oxlint), pnpm run test (Vitest unit tests), pnpm run test:e2e (Playwright), and pnpm run build to confirm TypeScript compilation succeeds with the new dependency versions.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}