How to Fix Stale Dependencies in Vibe-Coded Apps

Quick answer

Stale dependencies are outdated packages in your app that contain known vulnerabilities. AI coding tools like Cursor, Bolt.new, and v0 often generate code with pinned or cached versions that can be weeks or months old. To fix them, run an audit, update packages safely, and set up automated checks to prevent future drift.

What to check first

Before diving into updates, confirm you have a dependency problem:

Why AI coding tools create stale dependencies

AI models are trained on data that has a cutoff date. When they generate a package.json, they often use the latest version available at training time — not the latest when you run the code. For example, a model trained in June might suggest Next.js 14.0.0, but by the time you deploy, 14.2.0 is out with critical fixes.

Additionally, AI tools often copy-paste configuration from boilerplate projects that were themselves generated weeks earlier. This compounds the lag.

Step-by-step fix

1. Audit your current dependencies

Run the built-in audit command:

npm audit

This lists vulnerabilities by severity. For a deeper check, use:

npm audit --json | grep -A 5 "critical"

If you have many results, focus on critical and high first.

2. Update packages safely

Use npm update for patch and minor updates (respects semver ranges):

npm update

For major updates, you need to manually bump the version in package.json or use npx npm-check-updates:

npx npm-check-updates -u
npm install

This updates all version ranges to the latest. Test thoroughly afterwards.

3. Pin critical security packages

Some packages (like next, express, passport) need careful version control. For these, use exact versions in dependencies and update manually after testing:

{
  "dependencies": {
    "next": "14.2.5",
    "express": "4.19.2"
  }
}

4. Automate checks with a CI pipeline

Add a package.json script:

"scripts": {
  "audit": "npm audit --audit-level=high"
}

Then run it in your CI (GitHub Actions, GitLab CI, etc.) to fail builds if vulnerabilities exist. Example GitHub Action step:

- name: npm audit
  run: npm audit --audit-level=high

5. Use a dedicated scanning tool

For apps built with AI, manual audits miss leaked secrets or misconfigurations. Use continuous security monitoring to automatically detect stale dependencies and other issues on every deploy.

Common mistakes

Pinning everything to exact versions

Exact versions prevent automatic patch updates. If you pin "react": "18.2.0", you miss security fixes in 18.2.1+. Use ^ or ~ to allow patch/minor updates, but be careful with major bumps.

Ignoring transitive dependencies

Your direct dependencies depend on others. A vulnerability in a sub-dependency (like axios -> follow-redirects) won't show in npm outdated directly. Always run npm audit to catch them.

Updating without testing

Especially in vibe-coded apps, a minor update can break something because the AI generated code that relied on a specific behavior. Always test after updating, ideally with a staging environment.

Using `npm update` for major versions

npm update only updates within the semver range. If you have "next": "^14.0.0", it won't upgrade to 15.x. You must manually change the range or use ncu.

Not checking lockfiles

Your package-lock.json can have old versions even after you update package.json. Delete the lockfile and regenerate it with npm install to ensure consistency.

How OverMCP helps

OverMCP automatically scans your app's dependencies every time you deploy to Vercel or push to GitHub. It alerts you to stale packages with known CVEs and even suggests the exact version to upgrade to. No manual audit needed.

FAQ

How often should I update dependencies?

At least once a month for critical packages. For apps handling sensitive data, set up weekly automated scans. Tools like OverMCP can alert you in real time.

Will updating break my app?

Possible, especially if the AI generated code relies on deprecated APIs. Always test in a staging environment. Use patch updates (e.g., from 14.0.0 to 14.0.1) for safe fixes.

What's the difference between `npm audit` and `npm outdated`?

npm outdated shows packages that have newer versions available. npm audit shows only packages with known security vulnerabilities. Both are useful: outdated for general freshness, audit for security.