Shipkit
DocsFeaturesPricing
DocsFeaturesPricing

Shipkit DocumentationBuild memory optimizationDevelopment GuideEnvironment VariablesError HandlingFile StructureMiddlewareRebranding Guide

Vercel Deployment Checks

Development GuideCLIDependency UpdatesDevToolsFeature FlagsAI PromptsSetup RequirementsSupply chaintRPCWeb Workers

FeaturesAIAnalytics IntegrationAuthenticationCMSDatabaseEmailHapticsPaymentsComponent RegistryStorageUIVisual BuilderWaitlist Feature

Quick StartDeploymentEnvironment VariablesFile StructureSetup Wizard

Caching & Rate LimitingContent ManagementError HandlingMarkdown and MDXMiddlewareProxy-Safe Server ActionsRebranding GuideWebhook Security Implementation GuideMulti-Zone ArchitectureVercel Deployment

IntegrationsPayload CMSDataFast Analytics IntegrationGoogle Analytics IntegrationGoogle Tag Manager IntegrationPostHogStatSig IntegrationUmami Analytics IntegrationAuth.js IntegrationBetter AuthClerkStack Auth IntegrationSupabase Authentication IntegrationBuilder.io IntegrationPayload CMS IntegrationAWS S3 IntegrationResend Email IntegrationUpstash Redis IntegrationVercel Blob IntegrationLemon SqueezyPolarStripe

API RoutesComponentsAPI Route SnippetsAuthentication SnippetsComponent SnippetsForm Handling SnippetsSnippets Introduction

    Dependency Updates

    Shipkit keeps dependencies fresh on a routine schedule so upgrades land as small, reviewable pull requests instead of one big painful sweep. Two layers cover this: automated Dependabot PRs (the default) and a manual escape hatch for one-off bumps.

    Automated: Dependabot

    Dependabot is configured in .github/dependabot.yml. Every Monday it opens grouped pull requests:

    • Production minor/patch — one PR batching all safe production dependency bumps.
    • Dev dependencies — one PR batching all dev dependency bumps.
    • Major bumps — opened individually so each gets a deliberate human review.
    • GitHub Actions — one PR for workflow action updates.

    It covers the root app (package.json) and reads Bun's bun.lock via the npm ecosystem. The CLI now lives in lacymorrow/shipkit-cli with its own dependency updates.

    Reviewing a Dependabot PR

    1. Let CI run (ci.yml, e2e.yml) — a green build is the baseline gate.
    2. Skim the linked changelog/release notes for each bumped package, especially anything touching auth, payments, or the consent/privacy layer (@c15t/*). Minor releases are usually safe; read the notes anyway.
    3. For grouped minor/patch PRs with green CI, merge. For major bumps, treat it like a feature change: read the migration guide, test the affected surface, then merge.

    Manual: on-demand updates

    When you need to bump something before the weekly cadence (a security fix, a specific release you're waiting on), do it by hand:

    bun run deps:check      # ncu — list what is outdated
bun run deps:update     # ncu -u — rewrite package.json to latest ranges
bun install             # refresh bun.lock
bun run typecheck       # confirm nothing broke
bun run lint            # confirm nothing broke

    To bump a single package instead of everything:

    bun update <package>            # within the current semver range
# or edit the version in package.json, then:
bun install

    Always run typecheck and lint after any update, and open a PR — never push dependency bumps straight to main.

    Where this applies

    This process ships in bones (the free starter) and flows to every downstream Shipkit site via the upstream sync. Each downstream repo inherits the same .github/dependabot.yml, so the whole family stays current without per-repo setup.