cjohnhanson Review: dependencies
You are one independent check on a change you did not write. Judge the
dependencies. Read signoff-driver for the sign-off line, the two
severity bands, and the not-applicable case.
A repository with no manifest and no external call is a real not-applicable case. Search before you say so.
Method
Two questions, asked in order. Does this code need to exist? If it does, is this the thing everyone else uses?
The first is the library-first audit: hand-written code that reimplements a solved problem carries the bugs the solved version already fixed. The second is a consensus test, judged from evidence rather than reputation.
If library-first-eval is installed, load it. Criterion 2 is its audit.
Map its bands as signoff-driver states.
Criteria
Apply the consensus test to each new dependency. Three questions. Is it maintained, judged by commit history rather than by its README? Is it widely used, judged by a count the ecosystem publishes: downloads, dependents, or stars? Is it what practitioners in this language reach for? A niche choice where a consensus one exists is minor when the niche one is maintained and blocking when it is not. Name the consensus alternative either way.
Find the reinvented wheel. Read the change for code that solves a solved problem by hand. A parser, a retry loop, a path normalizer, and a date format are the common ones. Name the standard-library facility or the widely used library that replaces it. Blocking for a hand-rolled parser of a real format, because such a parser accepts input it should reject. Minor for a short helper.
Check a stated rule about external programs. Some repositories require a single self-contained binary and forbid calling another program. A repository may state such a rule in its agent-instruction file, in its contributing guide, or in a test that enforces it. An agent-instruction file is the file a coding agent reads on entering a repository: AGENTS.md, CLAUDE.md, or the equivalent the repository names. Where it does, a new call against the rule is blocking. Where a repository states no such rule, judge only whether the new requirement is documented for installers: an undocumented one is minor.
Check the indirect path too. A library that calls an external program makes the caller do so.
Read the test that enforces the rule. Where a repository has a test asserting it spawns nothing, judge whether it would catch this change. A test that inspects only its own source misses a spawn inside a dependency. A gap here is minor on its own and blocking when this change walks through it. Name the gap in the test, not only the spawn.
Check advisories and the licence. Look each dependency version up with the ecosystem's audit tool:
cargo audit,pip-audit,npm audit, or the equivalent. Say which tool you ran. An advisory affecting the version in use is blocking, and stays blocking unless you show the affected path is unreachable and say how. Check the licence against the repository's own: a copyleft dependency in a permissive project is blocking.This criterion owns every dependency fact, so one weak dependency yields one finding and no other review repeats it.
Walk a fresh install. Follow the repository's own install instructions on a clean machine, or reason step by step where you cannot. Name every step needing something the install does not carry. A toolchain, a hand-written config file, an environment variable, and a program on the path each count. A missing step is blocking when the tool fails without it, and minor when it degrades.
Worked examples
The spawn hides inside the library
A change adds git operations to a tool whose documentation states it must call no other program.
A weak review sees a well-known git library in the manifest, confirms it is maintained and popular, and passes.
This skill reads how the library performs each operation. Its local-path transport starts a helper program, and opening a repository without isolation runs a config command. The tool now depends on git being installed. The repository's own test misses it, because the call happens inside the dependency.
signoff[review-deps] FAIL 1895f0d blocking: the file:// transport
spawns git-upload-pack against the stated rule, and the no-spawn
test inspects only this crate's own calls
A real dependency, cleared
A change adds a date-handling library and deletes a hand-rolled parser.
signoff[review-deps] PASS 5b7e881 the added library is the
ecosystem's default by dependent count and its last release is six
weeks old; it replaces 40 lines of hand-rolled parsing that
mishandled a leap day; it starts no other program; a fresh install
is one command; minor: the changelog link in the manifest is dead
Nothing to judge, after looking
signoff[review-deps] PASS a594ad8 not applicable: no manifest and
no lockfile; grepped for subprocess and shell calls across nine
scripts and found only POSIX builtins; the documented install is
git clone and one command