# Dependency Management Principles

> Apply dependency management best practices when adding, updating, or auditing project dependencies in go.mod, package.json, Cargo.toml, pubspec.yaml, or requirements.txt. Covers version pinning, vulnerability scanning, and dependency hygiene.

- Skill: `irahardianto/dependency-management-principles-3` (Agent Skill)
- Install (CLI): `npx skillmds@latest add irahardianto/dependency-management-principles-3`
- Raw SKILL.md: https://api.skillmd.com/api/skills/irahardianto/dependency-management-principles-3/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: irahardianto (https://skillmd.com/u/irahardianto)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/irahardianto/dependency-management-principles-3

---


## Dependency Management Principles

### Version Pinning

**Production:** Pin exact versions (1.2.3, not ^1.2.0)

- Prevents supply chain attacks  
- Prevents unexpected breakage from patch updates  
- Ensures reproducible builds

**Use lock files:**

- `package-lock.json` (Node.js / npm)  
- `pnpm-lock.yaml` (Node.js / pnpm)  
- `yarn.lock` (Node.js / yarn)  
- `Cargo.lock` (Rust)  
- `go.sum` (Go)  
- `pubspec.lock` (Flutter / Dart)  
- `requirements.txt` / `poetry.lock` (Python)

### Minimize Dependencies

**Every dependency is a liability:**

- Potential security vulnerability  
- Increased build time and artifact size  
- Maintenance burden (updates, compatibility)

**Ask before adding dependency:**

- "Can I implement this in 50 lines?"  
- "Is this functionality critical?"  
- "Is this dependency actively maintained?"  
- "Is this the latest stable version?"

### Organize Imports

**Grouping:**

1. Standard library  
2. External dependencies  
3. Internal modules

**Sorting:** Alphabetical within groups

**Cleanup:** Remove unused imports (use linter/formatter)

### Dependency Management Checklist

- [ ] Are production dependencies pinned to exact versions?
- [ ] Is the lock file committed to version control?
- [ ] Can each dependency be justified (not implementable in <50 lines)?
- [ ] Are all dependencies actively maintained and on latest stable versions?
- [ ] Are imports organized by group (stdlib → external → internal)?
- [ ] Are unused imports removed?

### Related Principles
- Security Mandate @.claude/rules/security-mandate.md
- Security Principles @.claude/rules/security-principles.md