How to keep dependencies up to date in Replit

Open the Shell tab from the Tools sidebar in Replit. For Node.js projects, run npm outdated to see a table of packages with their current version, the wanted version (matching your semver range), and the latest available version. For Python projects, run pip list --outdated to see packages with available updates. Red entries in npm outdated indicate packages with available updates that fall within your specified version range. Yellow entries indicate new major versions that require explicit updating. Review the list before updating anything.

1# Node.js: check outdated packages
2npm outdated
3
4# Python: check outdated packages
5pip list --outdated
6
7# Ruby: check outdated gems
8bundle outdated

For minor and patch updates that stay within your semver range, run npm update to update all packages at once. For Python, use pip install --upgrade package-name to update individual packages. Avoid updating everything at once for major versions. Instead, update one package at a time, test your app after each update, and commit the working state before moving to the next package. This way, if something breaks, you know exactly which update caused the issue and can revert to the previous commit.

1# Node.js: update all packages within semver range
2npm update
3
4# Node.js: update a specific package to latest
5npm install package-name@latest
6
7# Python: update a specific package
8pip install --upgrade requests
9
10# Python: update all packages (use with caution)
11pip list --outdated --format=columns | tail -n +3 | awk '{print $1}' | xargs pip install --upgrade
12
13# Ruby: update gems
14bundle update

Version pinning ensures that everyone working on the project and every deployment uses the exact same package versions. For Node.js, the package-lock.json file already pins exact versions. Make sure it is committed to Git and not listed in .gitignore. For Python, generate a requirements.txt with pinned versions using pip freeze. For Ruby, the Gemfile.lock serves the same purpose. Lock files prevent the situation where your app works in the Replit workspace but breaks in deployment because a dependency installed a different version.

1# Node.js: package-lock.json is created automatically
2# Make sure it's committed to Git (not in .gitignore)
3
4# Python: generate pinned requirements
5pip freeze > requirements.txt
6
7# Example requirements.txt with pinned versions:
8# flask==3.0.2
9# requests==2.31.0
10# sqlalchemy==2.0.25
11
12# Ruby: Gemfile.lock is created by bundle install
13# Always commit Gemfile.lock to Git

Dependabot is GitHub's built-in tool that automatically creates pull requests when new versions of your dependencies are released. Connect your Replit project to GitHub first (Tools > Git > Connect to GitHub). Then create a .github/dependabot.yml file in your project that tells Dependabot which package ecosystems to monitor and how often to check. Dependabot creates individual pull requests for each update with a changelog summary, making it easy to review and merge updates from Replit's Git pane.

1# .github/dependabot.yml
2version: 2
3updates:
4  # Node.js npm dependencies
5  - package-ecosystem: "npm"
6    directory: "/"
7    schedule:
8      interval: "weekly"
9      day: "monday"
10    open-pull-requests-limit: 10
11    labels:
12      - "dependencies"
13
14  # Python pip dependencies (if applicable)
15  - package-ecosystem: "pip"
16    directory: "/"
17    schedule:
18      interval: "weekly"
19    open-pull-requests-limit: 5

When Dependabot creates a pull request on GitHub, review it by checking the changelog and compatibility notes in the PR description. If the update is a minor or patch version, it is usually safe to merge directly. For major version updates, merge the PR on GitHub, then pull the changes in Replit's Git pane and test your app thoroughly. If something breaks, you can revert the merge commit on GitHub and pull again in Replit to restore the previous state. This workflow keeps your dependencies current with minimal effort.