Review SDK upgrades as execution changes

A swap SDK update can change route construction, typed-data encoding or transaction defaults even when the interface looks identical. Review it as part of the execution pipeline.

The npm lockfile documentation explains how the lockfile records the dependency tree for reproducible installations. Commit and review the lockfile alongside manifest changes so the team knows which direct and transitive packages changed.

Inspect what the application delegates

Identify whether the package controls amount parsing, address selection, quote transport, order signing or calldata assembly. An update to a display-only helper and an update to a router encoder have different review needs.

Read the release notes and relevant interface changes from the maintained project. Version labels are useful signals but should not replace reviewing the code paths your integration depends on.

Compare semantic outputs

Run representative fixtures through the previous and proposed dependency set. Compare chain, recipient, spender, spend bound, minimum received, native value and typed-data domain. If bytes change, determine whether the change is expected; if bytes remain the same, still verify that runtime behavior and errors have not changed.

Use a compatible decoder for payload inspection and retain the version used. A decoder upgrade can change the interpretation displayed during review even when the submitted bytes are unchanged.

Keep rollback possible

Deploy behind the relevant execution controls and retain the previous build artifacts. Stop creating new payloads with a problematic release while continuing to track transactions created before rollback.

Lockfiles and integrity metadata help identify what was installed; they do not prove that a package is trustworthy. Review provenance, installation behavior and unexpected dependency additions according to the project's established process.

A useful change record states which execution responsibilities changed, which fixtures were checked and what remains unverified. Do not label an upgrade tested against live settlement unless that test actually occurred.