# Dependency Updates Checklist

Whenever any `package.json` (root, `client/`, or `sas/`) or lockfile is modified, run the same checks CI runs before pushing:

1. **npm audit** (must be clean for prod deps):
   ```bash
   npm audit --omit=dev            # in repo root
   cd sas && npm audit --omit=dev
   cd ../client && npm audit --omit=dev
   ```
   Fix with `npm audit fix`, targeted `overrides` in `package.json`, or version bumps — never `npm audit fix --force` blindly, as it can introduce breaking changes.

2. **License checker** (client only):
   ```bash
   cd client && npm run license-checker
   ```
   If a new dependency fails, either add its SPDX id to the `onlyAllow` list in `client/licenseChecker.js` (if the license is acceptable, e.g. permissive ones like `BlueOak-1.0.0`) or add the specific package to `excludePackages` with justification. Data Controller ships on-prem, so only OSI-approved permissive licenses are acceptable for production dependencies.

Both checks run in `.gitea/workflows/build.yaml` (`Check audit` and `Licence checker` steps) and will fail the build if skipped locally.
