ui5wc-upgrade — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited ui5wc-upgrade (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Follow each step in order. Do NOT skip verification gates.
Ensure the working tree is clean before starting (git status should show no uncommitted changes). The upgrade touches many files across multiple packages, and a dirty tree makes it hard to isolate upgrade-related changes and risks committing unrelated work.
2.25.0 or 2.25.1).~TARGET_VERSION for peerDependencies (e.g. ~2.25.1).package.json → dependencies["@ui5/webcomponents"].dependencies["@ui5/webcomponents"] already matches target, note that Step 1a can be skipped.package.jsonSkip if Renovate already handled this.
Update to the exact target version:
dependencies: @ui5/webcomponents, @ui5/webcomponents-fiori, @ui5/webcomponents-ai, @ui5/webcomponents-compat, @ui5/webcomponents-icons
devDependencies: @ui5/webcomponents-tools
@ui5/webcomponents-base is NOT a direct root dependency — only update it in peerDependencies.Update tilde ranges to ~TARGET_VERSION in all sub-packages. See references/package-json-peer-deps.md for the exact map. Summary:
| File | Keys to update |
|---|---|
packages/main/package.json | @ui5/webcomponents, -base, -fiori, -icons |
packages/base/package.json | @ui5/webcomponents-base |
packages/ai/package.json | @ui5/webcomponents-ai |
packages/compat/package.json | @ui5/webcomponents-compat, @ui5/webcomponents-react |
packages/cypress-commands/package.json | @ui5/webcomponents, -base |
Note:packages/charts/package.jsonuses caret ranges (^) and does not need updating for minor version bumps.
yarn installgrep -r "~OLD_MINOR" packages/*/package.jsonMust return zero results (replace OLD_MINOR with the previous minor version tilde range).
Run in sequence:
yarn create-webcomponents-wrapper
yarn create-webcomponents-wrapper-ai
yarn create-webcomponents-wrapper-compatEach script compiles the CLI internally before generating. No separate tsc step needed.
create-webcomponents-wrapper already runs prettier, eslint --fix, and sb:prepare-cem.
All commands exit 0. Then check for new components:
git diff --stat
git status --short -- packages/main/src/webComponents/ packages/ai/src/components/ packages/compat/src/components/ | grep "^?"If any command fails, see references/common-pitfalls.md.
The wrapper generator overwrites ALL files, including ones with hand-written customizations. These components have custom code that MUST be restored after every generation run. See references/custom-wrapper-code.md for the exact code to restore.
Components with custom code:
| Component | Package | Custom Code |
|---|---|---|
ExpandableText | main | addCustomCSSWithScoping for whitespace, DeprecatedExpandableTextProps interface |
Table | compat | getCompatCustomElementsScopingSuffix + tag name suffix |
TableCell | compat | Same scoping suffix pattern |
TableColumn | compat | Same scoping suffix pattern |
TableGroupRow | compat | Same scoping suffix pattern |
TableRow | compat | Same scoping suffix pattern |
Procedure:
references/custom-wrapper-code.md for the custom code to merge.have changed — integrate the custom additions with the new generated base.
automatically resolved (e.g., a type the custom code depends on was removed), STOP and inform the user with details of the conflict.
(new props, changed types, updated JSDoc), inform the user that these components had generated changes that were merged with existing custom code.
git diff packages/compat/src/components/Table/index.tsx
git diff packages/compat/src/components/TableCell/index.tsx
git diff packages/compat/src/components/TableColumn/index.tsx
git diff packages/compat/src/components/TableGroupRow/index.tsx
git diff packages/compat/src/components/TableRow/index.tsx
git diff packages/main/src/webComponents/ExpandableText/index.tsxEach file should show ONLY the expected generated changes (updated props, JSDoc, etc.) while retaining all custom code blocks.
yarn create-theming-parametersgit diff packages/base/src/styling/ThemingParameters.tsNote added/removed CSS variable mappings for the PR description.
Edit config/version-info.json — add a new entry before the closing }:
"X.Y.0": "TARGET_VERSION"The key is the React wrapper minor version (X.Y.0), the value is the upstream @ui5/webcomponents target version from the argument. The React wrapper version itself is bumped by lerna during the release.
node -e "JSON.parse(require('fs').readFileSync('config/version-info.json','utf8'));console.log('OK')"ls packages/main/src/themes/*.cssCompare against the Theme enum in packages/main/src/enums/Theme.ts.
Check the UI5 Web Components release notes for theme additions/removals/consolidations.
If themes changed, follow references/theme-and-storybook-checklist.md. If not, skip.
From the git status --short ... | grep "^?" output in Step 2, look for new untracked directories under:
packages/main/src/webComponents/packages/ai/src/components/packages/compat/src/components/The wrapper generator does NOT update barrel index.ts files. For each new component, add an export line in alphabetical order:
packages/main/src/webComponents/index.ts → export * from './<Name>/index.js';packages/ai/src/components/index.ts (if AI component)packages/compat/src/components/index.ts (if compat component)This must happen BEFORE `yarn build` — otherwise tsc won't compile new components into dist/, and create-exports will miss them.
For abstract components (@abstract in JSDoc) or subcomponents (items/options that slot into a parent):
.stories.tsx.mdx docs (import, Canvas, Description, ArgTypes)For standalone new components:
<ComponentDir>/<Name>.stories.tsx and <ComponentDir>/<Name>.mdxIf no new components, skip this step.
From the wrapper diff, check:
7a. Removed or renamed props — deleted lines in interface *Attributes blocks.
7b. Changed event signatures — changes in event detail type imports.
7c. Removed components — entire component directories deleted.
7d. Impact on custom components:
grep -r "ChangedTypeName\|RemovedPropName" packages/main/src/components/Present findings prominently:
## BREAKING CHANGES DETECTED
### <ComponentName>
- Removed prop: `oldProp`
- Renamed: `oldName` → `newName`If none: "No breaking changes detected in generated wrappers."
yarn buildThen lint the changed wrapper files (full yarn lint may OOM on this repo):
node --max-old-space-size=8192 ./node_modules/.bin/eslint packages/main/src/webComponents/*/index.tsx packages/compat/src/components/*/index.tsx packages/ai/src/components/*/index.tsxIf lint fails, try adding --fix first.
yarn create-exportsThis reads dist/ directories to update package.json exports maps for new components.
If new components were added, check that their exports are in correct alphabetical order in the package.json exports map. create-exports may append them at the end — move them to the correct position manually.
If new components were added (Step 6), update the category mapping:
packages/mcp-server/src/utils/component-config.ts — Add new components to the appropriate category arrayThen rebuild:
yarn build:mcpVerify it completes without "missing category definitions" errors.
Build, lint, and create-exports all exit 0. Check if create-exports modified any package.json files:
git diff packages/*/package.jsonRenovate handles examples, templates, and patterns — skip those.
Only update:
docs/Welcome.mdx — if theme list or version table changedReview git status before staging. Only stage upgrade-related files — avoid sweeping git add -A if unrelated changes are present.
git add package.json yarn.lock config/version-info.json \
packages/*/package.json \
packages/main/src/webComponents/ \
packages/ai/src/components/ \
packages/compat/src/components/ \
packages/base/src/styling/ThemingParameters.ts \
.storybook/custom-element-manifests/
git commit -m "feat: update to UI5 Web Components X.Y.0"## Summary
- Update `@ui5/webcomponents` family from A.B.C to X.Y.0
- Regenerated wrapper components for main, fiori, AI, and compat packages
- Synced ThemingParameters
## New Components
<!-- List or "None" -->
## Breaking Changes
<!-- List or "None detected" -->
## Theme Changes
<!-- List or "None" -->
## ThemingParameters Changes
<!-- Added/removed CSS variables or "None" -->git push -u origin feat/ui5wc-X.Y.0
gh pr create --title "feat: update to UI5 Web Components X.Y.0" --body "<body>"| Script | Purpose |
|---|---|
yarn install | Install after version bumps |
yarn create-webcomponents-wrapper | Main + fiori wrappers + prettier + eslint + CEM |
yarn create-webcomponents-wrapper-ai | AI wrappers |
yarn create-webcomponents-wrapper-compat | Compat wrappers |
yarn create-theming-parameters | Regenerate ThemingParameters.ts |
yarn create-exports | Regenerate package.json exports maps (needs dist/) |
yarn build | Full monorepo build |
yarn build:mcp | Rebuild MCP server (after new components) |
yarn lint | ESLint (may OOM — use targeted lint instead) |
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.