When preparing merge request we should follow these steps. As an example, we can consider send 0.18.0 and mime 3.0 transition.

== Step 1 ==
Clone the upstream repo (https://github.com/pillarjs/send). You might also create a fork and clone from your fork (this will help when sending a merge request later).

{{{
(debian-sid)pravi@mahishi:~/forge/js-team/upstream$ git clone https://github.com/pillarjs/send.git
Cloning into 'send'...
remote: Enumerating objects: 2451, done.
remote: Counting objects: 100% (364/364), done.
remote: Compressing objects: 100% (96/96), done.
remote: Total 2451 (delta 218), reused 351 (delta 213), pack-reused 2087
Receiving objects: 100% (2451/2451), 471.90 KiB | 1.15 MiB/s, done.
Resolving deltas: 100% (1534/1534), done.
(debian-sid)pravi@mahishi:~/forge/js-team/upstream$ cd send/
(debian-sid)pravi@mahishi:~/forge/js-team/upstream/send$ ls
appveyor.yml  HISTORY.md  index.js  LICENSE  package.json  README.md  SECURITY.md  test
}}}

== Step 2 ==
Install dependencies using upstream preferred package manager (yarn.lock indicates yarn and package-lock.json indicates npm). We can run `npm install` as upstream did not indicate a preferred package manager.

{{{
(debian-sid)pravi@mahishi:~/forge/js-team/upstream/send$ npm install

added 410 packages, and audited 411 packages in 31s

97 packages are looking for funding
  run `npm fund` for details

}}}

== Step 3 ==
Confirm the tests are passing currently by running `npm run test`

{{{
(debian-sid)pravi@mahishi:~/forge/js-team/upstream/send$ npm run test

> send@0.18.0 test
> mocha --check-leaks --reporter spec --bail



  send(file).pipe(res)
    ✔ should stream the file contents (44ms)
    ✔ should stream a zero-length file
    ✔ should decode the given path as a URI
    ✔ should serve files with dots in name
    ✔ should treat a malformed URI as a bad request
    ✔ should 400 on NULL bytes
    ✔ should treat an ENAMETOOLONG as a 404
    ✔ should handle headers already sent error
    ✔ should support HEAD
 
[...]

  send.mime
    ✔ should be exposed
    .default_type
      ✔ should change the default type
      ✔ should not add Content-Type for undefined default


  154 passing (703ms)
}}}

== Step 4 ==
Now update package.json with your favorite text editor in case of npm or run `yarn upgrade` in case of yarn to update the dependencies to match the version in Debian. 

{{{
(debian-sid)pravi@mahishi:~/forge/js-team/upstream/send$ micro package.json 
(debian-sid)pravi@mahishi:~/forge/js-team/upstream/send$ git diff
diff --git a/package.json b/package.json
index 7f269d5..48b7355 100644
--- a/package.json
+++ b/package.json
@@ -24,7 +24,7 @@
     "etag": "~1.8.1",
     "fresh": "0.5.2",
     "http-errors": "2.0.0",
-    "mime": "1.6.0",
+    "mime": "~3.0",
     "ms": "2.1.3",
     "on-finished": "2.4.1",
}}}

For npm, run `npm install` (yarn will do this automatically). Verify at least 1 package is changed in the output before proceeding.

{{{
(debian-sid)pravi@mahishi:~/forge/js-team/upstream/send$ npm install

changed 1 package, and audited 411 packages in 4s

97 packages are looking for funding
  run `npm fund` for details
}}}

== Step 5 ==
Now run the tests with new version. For example `npm run test` or `yarn test`

{{{
(debian-sid)pravi@mahishi:~/forge/js-team/upstream/send$ npm run test

> send@0.18.0 test
> mocha --check-leaks --reporter spec --bail



  send(file).pipe(res)
    1) should stream the file contents


  0 passing (37ms)
  1 failing

  1) send(file).pipe(res)
       should stream the file contents:
     Uncaught TypeError: mime.lookup is not a function
      at SendStream.type (index.js:830:19)
      at SendStream.send (index.js:623:8)
      at onstat (index.js:725:10)
}}}

== Step 6 ==
Fix the breaking tests by adapting to newer API. You can see this patch -> https://salsa.debian.org/js-team/node-send/-/blob/91f167d9e6c27ef33f5c8b175604e2144a03155b/debian/patches/fix-for-mime-2.patch for how it was adapted.

== Step 7 ==
Push your changes to a new branch and send merge request. Since this change was already implemented upstream in 1.0.0-beta.1 release, we did not have to send a pull request.