Modernization audit

Modernization & Dependency Audit

Perform a focused dependency and modernization review as a Senior Cloud Infrastructure Engineer + Principal Platform Engineer + Principal Software Architect. Output one self-contained report, modernization-audit.md, in the repository root. Analysis only — never modify source.

Be factual about versions. Check the actual installed/declared versions against current releases before claiming something is outdated — read the manifest and lockfile, and where possible the release/advisory data (use a docs/web lookup or npm outdated/pip list --outdated style reasoning from the lockfile). An "upgrade X" recommendation with no version evidence is worthless. If you can't confirm currency or a CVE, say "Insufficient evidence to conclude."

Workflow

1. Inventory the stack. Read the package manifest(s) and lockfile, runtime/engine versions (Dockerfile base image, .nvmrc, engines), framework config, CI/CD, and deployment/infra files. Establish exactly what versions are in use.
2. Dispatch specialist passes (concurrently) via audit-specialist (fallback general-purpose), READ-ONLY, returning evidence with file:line:
   • Dependency currency & risk — outdated majors, deprecated/unmaintained packages, known-vulnerable versions (cross-reference advisories), duplicate/unused deps, lockfile hygiene, runtime EOL (e.g. Node/Python version support).
   • Framework & language modernization — newer framework capabilities left unused, legacy patterns superseded by language features, tooling upgrades (build/test/lint).
   • Platform & future-proofing — cloud readiness, containerization/deployment posture, observability, horizontal scalability, and genuinely-fitting AI opportunities.
3. Verify the high-impact claims yourself — confirm a flagged version is actually behind and the upgrade path is real (breaking changes, migration effort). Reconcile duplicates.
4. Write modernization-audit.md (structure below).

Finding format

Give each proposal a stable ID MOD-NNN with: Title · Priority · Current State (with the exact version/evidence, file:line) · Recommended State · Benefits · Migration Strategy · Risk · Estimated Effort. For a security-relevant outdated dependency, also cite the CVE/advisory.

Report structure

# <Project> — Modernization & Dependency Audit
(scope, method, date)
# Stack Inventory   (table: component · current version · latest · gap · risk)
# Dependency Findings   (outdated / vulnerable / deprecated / unused — MOD-* items)
# Framework & Language Modernization   (MOD-* items)
# Platform & Future-Proofing   (cloud readiness, observability, scaling, AI opportunities)
# Prioritized Upgrade Plan   (safe/isolated upgrades first; batch breaking changes; note what needs a test net first)
# Summary   (top 3 upgrades by ROI/risk)

Finish by telling the user the most urgent upgrades (especially any security-relevant ones) and the safest order to apply them. Confirm source is untouched (git status shows only modernization-audit.md).