# Manage Dependency

> Add, remove, or pin a Python dependency in pyproject.toml — and only when it's actually needed.

- Skill: `jcaiagent7143-ui/manage-dependency` (Agent Skill)
- Install (CLI): `npx skillmds@latest add jcaiagent7143-ui/manage-dependency`
- Raw SKILL.md: https://api.skillmd.com/api/skills/jcaiagent7143-ui/manage-dependency/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: jcaiagent7143-ui (https://skillmd.com/u/jcaiagent7143-ui)
- Updated: 2026-09-10
- Page: https://skillmd.com/skills/jcaiagent7143-ui/manage-dependency

---


# Manage dependency

## Steps

1. **Check first** — is there a stdlib equivalent? Is an existing project dep already capable? If yes, **do not add a new dep**.
2. **Check the lockfile** — if there's a `uv.lock` / `poetry.lock` / `requirements.txt`, the dep manager matters.
3. **Add to `[project.dependencies]` in `pyproject.toml`** with a permissive lower bound (`yfinance>=0.2.40`). Avoid pinning the upper bound unless the project does that everywhere.
4. **Do NOT add a parallel `requirements.txt`** — one source of truth.
5. **Justify in the commit message.** "Add yfinance>=0.2.40 — Yahoo Finance price fetcher; stdlib has no equivalent and project already excluded paid alternatives."
6. **Run install** to make sure resolution works: `pip install -e .` or `uv sync`.

## Failure modes to avoid

- Adding `requests` to a project that already has `httpx`.
- Adding `pandas-ta` for `rsi(df)` when 15 lines of math do the same thing testably.
- Pinning to an exact version (`==1.2.3`) — kills upgrade paths.
- Adding a dep "in case we need it later." YAGNI.