종속성 업데이트 에이전트

Role: Dependency update manager
Task: Weekly or on-demand:
1. Run npm/yarn/pnpm audit to find vulnerabilities and outdated packages
2. Separate findings:
   - Critical/high CVEs → immediate branch
   - Patch & minor updates → routine maintenance branch
   - Major version updates → per-package branches (evaluate breaking changes)
3. For each major update:
   - Check GitHub releases for breaking changes
   - Run full test suite with updated version
   - Report pass/fail and any deprecation warnings
4. Create GitHub branches and PRs grouped by risk tier
5. Add detailed PR description with:
   - Vulnerability CVE-IDs and severity (CVSS score if available)
   - Changelog highlights
   - Test results summary
   - "⚠️ This is a major version bump" flag for breaking updates

Example PR title format:
- "deps: security updates (npm audit)" → patch updates, no breaks
- "deps: urgent | CVE-2025-1234 (critical)" → security hot-fix
- "deps: major | react@19 + breaking changes" → major version bump

5. Auto-request code review from team (post in Slack/Teams)
6. Link PRs to AACWorkflow issues for tracking

# 매주 목요일 오전 10시
0 10 * * 4 curl -X POST https://aacworkflow.com/api/tasks \
  -H "Authorization: Bearer $TOKEN" \
  -d '{"agent_id": "dependency-bot", "title": "Weekly dependency scan"}'

dependency_audit:
  package_managers:
    - npm
    - pnpm
  auto_merge:
    enabled: true
    conditions:
      - type: patch
        only_if: all_tests_pass
      - type: minor
        only_if: all_tests_pass_and_no_deprecation_warnings
      - type: major
        only_if: manual_approval
  
  skip_packages:
    - react       # pin in package.json, don't auto-update
    - react-dom
    - expo        # mobile pinned
  
  priority:
    critical_cve: "auto-merge if tests pass"
    high_cve: "create PR, notify team"
    medium_cve: "batch with weekly update"
    patches: "batch with weekly update"

  notification:
    slack_channel: "#dependencies"
    mention_on_critical: "@security-team"

## Changes

- chalk 5.3.0 → 5.4.1 (patch)
- lodash-es 4.17.21 → 4.18.0 (minor)
- ts-node 10.9.1 → 10.9.2 (patch)

All changes are backwards compatible. Tests: ✅ PASS (1200 tests in 42s)

---
**Risk:** Low | No deprecation warnings | Routine maintenance
Merging this is safe.

## Vulnerability

**express 4.18.0 → 4.19.5** (patch)

⚠️ **CVE-2025-1234** — Request header parsing DoS
- CVSS Score: 7.5 (High)
- Affected: express < 4.19.5
- Fix: Backport in patch release

https://nvd.nist.gov/vuln/detail/CVE-2025-1234

## Action

This is a security patch with no breaking changes.

Tests: ✅ PASS (1200 tests in 40s)
No deprecation warnings.

---
**Risk:** Low (security patch only)
✅ Safe to merge immediately. Recommend merging today.

## Breaking Changes

**typescript 5.5.4 → 5.6.0** (major)

### Highlights
- Stricter null checking (new flag)
- Removed deprecated `ts.transpileOnly` option
- New `verbatimModuleSyntax` requirement for type imports

### Migration Required

Files needing updates:
- `tsconfig.json`: set `verbatimModuleSyntax: true`
- 3 files with bare `import type` → add `type` keyword

## Test Results

This PR is in **DRAFT** mode. Required steps to merge:
1. Fix tsconfig.json
2. Update import statements
3. Re-run tests (target: all green)
4. Get code review from @backend-lead

---
**Risk:** Medium | Requires migration | Recommend 1–2 day sprint