convex-migration-helper — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited convex-migration-helper (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Safely migrate Convex schemas and data when making breaking changes.
Convex will not let you deploy a schema that does not match the data at rest. This is the fundamental constraint that shapes every migration:
This means migrations follow a predictable pattern: widen the schema, migrate the data, narrow the schema.
Convex migrations run online, meaning the app continues serving requests while data is updated asynchronously in batches. During the migration window, your code must handle both old and new data formats.
When changing the shape of data, create a new field rather than modifying an existing one. This makes the transition safer and easier to roll back.
Unless you are certain, prefer deprecating fields over deleting them. Mark the field as v.optional and add a code comment explaining it is deprecated and why it existed.
// Before
users: defineTable({
name: v.string(),
})
// After - safe, new field is optional
users: defineTable({
name: v.string(),
bio: v.optional(v.string()),
})posts: defineTable({
userId: v.id("users"),
title: v.string(),
}).index("by_user", ["userId"])users: defineTable({
name: v.string(),
email: v.string(),
})
.index("by_email", ["email"])Every breaking migration follows the same multi-deploy pattern:
Deploy 1 - Widen the schema:
Between deploys - Migrate data:
Deploy 2 - Narrow the schema:
For any non-trivial migration, use the @convex-dev/migrations component. It handles batching, cursor-based pagination, state tracking, resume from failure, dry runs, and progress monitoring.
See references/migrations-component.md for installation, setup, defining and running migrations, dry runs, status monitoring, and configuration options.
See references/migration-patterns.md for complete patterns with code examples covering:
.collect() is only safe for tables you know are small.dryRun: true to validate migration logic before committing changes to production data. Catches bugs before they touch real documents.v.optional and a comment. Only delete after you are confident the data is no longer needed and no code references it.@convex-dev/migrations componentdryRun: true~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.