When preparing merge request we should follow these steps. As an example, we can consider send 0.18.0 and mime 3.0 transition.

Step 1

Clone the upstream repo (https://github.com/pillarjs/send). You might also create a fork and clone from your fork (this will help when sending a merge request later). 

(debian-sid)pravi@mahishi:~/forge/js-team/upstream$ git clone https://github.com/pillarjs/send.git
Cloning into 'send'...
remote: Enumerating objects: 2451, done.
remote: Counting objects: 100% (364/364), done.
remote: Compressing objects: 100% (96/96), done.
remote: Total 2451 (delta 218), reused 351 (delta 213), pack-reused 2087
Receiving objects: 100% (2451/2451), 471.90 KiB | 1.15 MiB/s, done.
Resolving deltas: 100% (1534/1534), done.
(debian-sid)pravi@mahishi:~/forge/js-team/upstream$ cd send/
(debian-sid)pravi@mahishi:~/forge/js-team/upstream/send$ ls
appveyor.yml  HISTORY.md  index.js  LICENSE  package.json  README.md  SECURITY.md  test

Step 2

Install dependencies using upstream preferred package manager (yarn.lock indicates yarn and package-lock.json indicates npm). We can run npm install as upstream did not indicate a preferred package manager. 

(debian-sid)pravi@mahishi:~/forge/js-team/upstream/send$ npm install

added 410 packages, and audited 411 packages in 31s

97 packages are looking for funding
  run `npm fund` for details

Step 3

Confirm the tests are passing currently by running npm run test 

(debian-sid)pravi@mahishi:~/forge/js-team/upstream/send$ npm run test

> send@0.18.0 test
> mocha --check-leaks --reporter spec --bail



  send(file).pipe(res)
    ✔ should stream the file contents (44ms)
    ✔ should stream a zero-length file
    ✔ should decode the given path as a URI
    ✔ should serve files with dots in name
    ✔ should treat a malformed URI as a bad request
    ✔ should 400 on NULL bytes
    ✔ should treat an ENAMETOOLONG as a 404
    ✔ should handle headers already sent error
    ✔ should support HEAD
 
[...]

  send.mime
    ✔ should be exposed
    .default_type
      ✔ should change the default type
      ✔ should not add Content-Type for undefined default


  154 passing (703ms)

Step 4

Now update package.json with your favorite text editor in case of npm or run yarn upgrade in case of yarn to update the dependencies to match the version in Debian. 

(debian-sid)pravi@mahishi:~/forge/js-team/upstream/send$ micro package.json 
(debian-sid)pravi@mahishi:~/forge/js-team/upstream/send$ git diff
diff --git a/package.json b/package.json
index 7f269d5..48b7355 100644
--- a/package.json
+++ b/package.json
@@ -24,7 +24,7 @@
     "etag": "~1.8.1",
     "fresh": "0.5.2",
     "http-errors": "2.0.0",
-    "mime": "1.6.0",
+    "mime": "~3.0",
     "ms": "2.1.3",
     "on-finished": "2.4.1",

For npm, run npm install (yarn will do this automatically). Verify at least 1 package is changed in the output before proceeding. 

(debian-sid)pravi@mahishi:~/forge/js-team/upstream/send$ npm install

changed 1 package, and audited 411 packages in 4s

97 packages are looking for funding
  run `npm fund` for details

Step 5

Now run the tests with new version. For example npm run test or yarn test 

(debian-sid)pravi@mahishi:~/forge/js-team/upstream/send$ npm run test

> send@0.18.0 test
> mocha --check-leaks --reporter spec --bail



  send(file).pipe(res)
    1) should stream the file contents


  0 passing (37ms)
  1 failing

  1) send(file).pipe(res)
       should stream the file contents:
     Uncaught TypeError: mime.lookup is not a function
      at SendStream.type (index.js:830:19)
      at SendStream.send (index.js:623:8)
      at onstat (index.js:725:10)

Step 6

Fix the breaking tests by adapting to newer API. You can see this patch -> https://salsa.debian.org/js-team/node-send/-/blob/91f167d9e6c27ef33f5c8b175604e2144a03155b/debian/patches/fix-for-mime-2.patch for how it was adapted.

Step 7

Push your changes to a new branch and send merge request. Since this change was already implemented upstream in 1.0.0-beta.1 release, we did not have to send a pull request.