Dependency Management
Safely manage project dependencies at scale.
Version Strategy
Pinning Approaches
| Strategy | Format | Risk | Best For |
|---|---|---|---|
| Exact | 1.2.3 |
Low | Docker, CI, production |
| Caret | ^1.2.3 |
Medium | Libraries, apps with good tests |
| Tilde | ~1.2.3 |
Low-Medium | Conservative updates |
| Range | >=1.2.3 <2.0.0 |
High | Rare, legacy |
| Floating | * |
Very High | Never in production |
Rule: Pin exact versions for production, caret for libraries.
Vulnerability Scanning
Tools
- npm audit /
yarn audit— quick JS check - Dependabot — GitHub-native, auto PRs
- Snyk — deeper scanning, prioritization
- Trivy — container scanning
- OWASP Dependency-Check — Java/.NET
Workflow
- Scan on every PR (fail on critical/high)
- Weekly full scan of all repos
- Patch critical (<7 days), high (<30 days)
- Track CVEs by severity in dashboard
- SBOM generation per release
Monorepo Patterns
- Use workspaces (npm/yarn/pnpm workspaces)
- Shared dependency versions (single source of truth)
- Independent vs locked version strategy
- Deduplicate (npx dedupe after major changes)
- Audit tree to find conflicting transitive deps
Upgrade Workflow
- Check changelog for breaking changes
- Run tests (you have tests, right?)
- Upgrade one major version at a time
- Run full test suite + build
- Deploy to staging, verify
- Monitor for regressions (logs, metrics, errors)