majiayu000 Dependency Management Skill
Safely manage and update project dependencies.
When to Use
- Updating outdated dependencies
- Auditing for security vulnerabilities
- Analyzing dependency compatibility
- Planning major version upgrades
- Reducing dependency bloat
Reference Documents
- Update Strategies - Safe update approaches
- Security Audit - Vulnerability scanning
- Compatibility Matrix - Tracking constraints
- Changelog Analysis - Reading changelogs
Core Workflow
1. Audit Current State
# Node.js
npm outdated
npm audit
# Python
pip list --outdated
pip-audit
# Ruby
bundle outdated
bundle audit
# Go
go list -m -u all
govulncheck ./...
2. Categorize Updates
| Category | Risk | Approach |
|---|---|---|
| Patch (0.0.x) | Low | Usually safe to batch |
| Minor (0.x.0) | Medium | Review changelog, test |
| Major (x.0.0) | High | Plan migration, extensive test |
| Security | Critical | Prioritize immediately |
3. Update Strategy
## Update Plan
### Immediate (Security)
- lodash: 4.17.15 → 4.17.21 (CVE-2021-23337)
- axios: 0.21.0 → 1.6.0 (CVE-2023-45857)
### This Sprint (Patch/Minor)
- jest: 29.5.0 → 29.7.0
- typescript: 5.0.4 → 5.3.0
- prettier: 3.0.0 → 3.1.0
### Planned (Major)
- react: 17.0.2 → 18.2.0 (requires migration)
- webpack: 4.x → 5.x (requires config changes)
4. Safe Update Process
# 1. Create update branch
git checkout -b deps/update-YYYY-MM-DD
# 2. Update one package at a time (for major updates)
npm install package@version
# 3. Run tests
npm test
# 4. Check for breaking changes
npm run build
npm run lint
# 5. Commit if passing
git commit -m "Update package to version"
# 6. Repeat or batch
Risk Assessment
Low Risk Updates
Safe to batch together:
# Update all patch versions
npm update
# Update specific minor versions
npm install package1@^2.1.0 package2@^3.2.0
Medium Risk Updates
Update individually with testing:
## Update: typescript 5.0 → 5.3
### Changelog Review
- New decorator syntax
- Improved type inference
- Breaking: stricter null checks
### Testing Plan
1. Run type checker
2. Run full test suite
3. Build production bundle
4. Test critical flows
### Rollback Plan
```bash
npm install typescript@5.0.4
### High Risk Updates
Require dedicated migration:
```markdown
## Migration: React 17 → 18
### Breaking Changes
- New root API (createRoot)
- Automatic batching
- Strict mode behavior changes
### Migration Steps
1. Update react and react-dom
2. Update to new root API
3. Fix strict mode warnings
4. Update testing library
5. Run full test suite
6. Manual QA of critical flows
### Timeline
- Sprint 1: Core migration
- Sprint 2: Fix deprecation warnings
- Sprint 3: Adopt new features
Security Prioritization
Severity Levels
| Level | Response Time | Action |
|---|---|---|
| Critical | Immediate | Emergency patch |
| High | 24-48 hours | Priority update |
| Medium | This sprint | Scheduled update |
| Low | Next sprint | Normal priority |
Vulnerability Response
## CVE Response Checklist
- [ ] Identify affected package and version
- [ ] Check if exploitable in our usage
- [ ] Find patched version
- [ ] Test update locally
- [ ] Deploy to staging
- [ ] Verify fix with security scan
- [ ] Deploy to production
- [ ] Document in security log
Dependency Hygiene
Regular Maintenance
## Weekly
- [ ] Check for security advisories
- [ ] Review critical dependency updates
## Monthly
- [ ] Run full dependency audit
- [ ] Update patch versions
- [ ] Review minor version updates
## Quarterly
- [ ] Plan major version migrations
- [ ] Assess unused dependencies
- [ ] Review dependency size impact
Removing Unused Dependencies
# Node.js - Find unused
npx depcheck
# Python - Find unused
pip-autoremove --list
# Review and remove
npm uninstall unused-package