# Dependency Management Principles

> Dependency management: version pinning, vulnerability scanning, dependency hygiene. go.mod, package.json, Cargo.toml, pubspec.yaml.

- Skill: `irahardianto/dependency-management-principles` (Agent Skill)
- Install (CLI): `npx skillmds@latest add irahardianto/dependency-management-principles`
- Raw SKILL.md: https://api.skillmd.com/api/skills/irahardianto/dependency-management-principles/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: irahardianto (https://skillmd.com/u/irahardianto)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/irahardianto/dependency-management-principles

---


## Dependency Management

### Version Pinning
Production: exact versions (1.2.3, not ^1.2.0). Prevents supply chain attacks, unexpected breakage. Reproducible builds.

Lock files: `package-lock.json`, `pnpm-lock.yaml`, `yarn.lock`, `Cargo.lock`, `go.sum`, `pubspec.lock`, `poetry.lock`.

### Minimize
Every dep = liability (security, build time, maintenance). Before adding: "50 lines to implement?" "Critical?" "Actively maintained?" "Latest stable?"

### Organize Imports
1. Standard library → 2. External deps → 3. Internal modules. Alphabetical within groups. Remove unused.

### Checklist
- [ ] Production deps pinned to exact versions
- [ ] Lock file committed
- [ ] Each dep justified (not <50 lines to implement)
- [ ] All deps maintained + latest stable
- [ ] Imports organized (stdlib→external→internal)
- [ ] Unused imports removed
- [ ] CVE scan clean (run before every release)
- [ ] Licenses audited against project allowlist

### Vulnerability Scanning
Run per-language CVE scanner as part of CI. Fail on critical/high severity.
For the full per-language command reference and SBOM/license compliance procedures, load:
→ `@.gemini/skills/supply-chain-security/SKILL.md`

### Related
- Security Mandate GEMINI.md § Security Mandate
- Security Principles GEMINI.md § Security Principles
- Supply Chain Security @.gemini/skills/supply-chain-security/SKILL.md