lurui1997 Dependency Management
Keep dependencies secure, current, and lean.
Security
- Run vulnerability scans regularly (
npm audit,pip-audit,cargo audit, Snyk). - Triage findings by severity and exploitability; patch critical issues immediately.
- Record exceptions with a risk rationale and review date.
Updates
- Apply patch and minor updates frequently to reduce upgrade risk.
- Read changelogs for breaking changes before major version bumps.
- Test upgrades in a branch with full CI before merging.
Lockfiles
- Treat lockfiles as source-controlled artifacts; never edit them manually.
- Resolve conflicts by regenerating the lockfile from the manifest after merging dependency changes.
Cleanup
- Periodically scan for unused dependencies and remove them.
- Monitor install size and binary bloat; replace heavy libraries when lighter alternatives exist.
Rollback Plan
- Pin critical dependency versions in the manifest before large upgrades.
- Keep a passing baseline build on the previous version until the upgrade is validated in production.