Dependency Management — Production Patterns
Modern Best Practices (2025): Lockfile-first workflows, automated security scanning (Dependabot, Snyk), semantic versioning, minimal dependencies principle, monorepo workspaces (pnpm, Nx), supply chain security (SBOM, signatures), and reproducible builds.
When to Use This Skill
Claude should invoke this skill when a user requests:
- Adding new dependencies to a project
- Updating existing dependencies safely
- Resolving dependency conflicts or version mismatches
- Auditing dependencies for security vulnerabilities
- Understanding lockfile management and reproducible builds
- Setting up monorepo workspaces (pnpm, npm, yarn)
- Managing transitive dependencies and overrides
- Choosing between similar packages (bundle size, maintenance, security)
- Dependency version constraints and semantic versioning
- Dependency security best practices and supply chain security
- Troubleshooting "dependency hell" scenarios
- Package manager configuration and optimization
- Creating reproducible builds across environments
Quick Reference
| Task |
Tool/Command |
Key Action |
When to Use |
| Install from lockfile |
npm ci, poetry install, cargo build |
Clean install, reproducible |
CI/CD, production deployments |
| Add dependency |
npm install <pkg>, poetry add <pkg> |
Updates lockfile automatically |
New feature needs library |
| Update dependencies |
npm update, poetry update, cargo update |
Updates within version constraints |
Monthly/quarterly maintenance |
| Check for vulnerabilities |
npm audit, pip-audit, cargo audit |
Scans for known CVEs |
Before releases, weekly |
| View dependency tree |
npm ls, pnpm why, pipdeptree |
Shows transitive dependencies |
Debugging conflicts |
| Override transitive dep |
overrides (npm), pnpm.overrides |
Force specific version |
Security patch, conflict resolution |
| Monorepo setup |
pnpm workspaces, npm workspaces |
Shared dependencies, cross-linking |
Multi-package projects |
| Check outdated |
npm outdated, poetry show --outdated |
Lists available updates |
Planning update sprints |
Decision Tree: Dependency Management
User needs: [Dependency Task]
├─ Adding new dependency?
│ ├─ Check: Do I really need this? (Can implement in <100 LOC?)
│ ├─ Check: Is it well-maintained? (Last commit <6 months, >10k downloads/week)
│ ├─ Check: Bundle size impact? (Use Bundlephobia for JS)
│ ├─ Check: Security risks? (`npm audit`, Snyk)
│ └─ If all checks pass → Add with `npm install <pkg>` → Commit lockfile
│
├─ Updating dependencies?
│ ├─ Security vulnerability? → `npm audit fix` → Test → Deploy immediately
│ ├─ Routine update?
│ ├─ Patch versions → `npm update` → Safe, do frequently
│ ├─ Minor/major → Check CHANGELOG → Test in staging → Update gradually
│ └─ All at once → [FAIL] RISKY → Update in batches instead
│
├─ Dependency conflict?
│ ├─ Transitive dependency issue?
│ ├─ View tree: `npm ls <package>`
│ ├─ Use overrides sparingly: `overrides` in package.json
│ └─ Document why override is needed
│ └─ Peer dependency mismatch?
│ └─ Check version compatibility → Update parent or child
│
├─ Monorepo project?
│ ├─ Use pnpm workspaces (fastest, best)
│ ├─ Shared deps → Root package.json
│ ├─ Package-specific → Package directories
│ └─ Use Nx or Turborepo for task caching
│
└─ Choosing package manager?
├─ New project → **pnpm** (3x faster, 1/3 disk space)
├─ Existing npm project → Migrate or stay (check team preference)
├─ Python → **Poetry** (apps), pip+venv (simple)
└─ Data science → **conda** (environment management)
Navigation: Core Patterns
Lockfile Management
resources/lockfile-management.md
Lockfiles ensure reproducible builds by recording exact versions of all dependencies (direct + transitive). Essential for preventing "works on my machine" issues.
- Golden rules (always commit, never edit manually, regenerate on changes)
- Commands by ecosystem (npm ci, poetry install, cargo build)
- Troubleshooting lockfile conflicts
- CI/CD integration patterns
Semantic Versioning (SemVer)
resources/semver-guide.md
Understanding version constraints (^, ~, exact) and how to specify dependency ranges safely.
- SemVer format (MAJOR.MINOR.PATCH)
- Version constraint syntax (caret, tilde, exact)
- Recommended strategies by project type
- Cross-ecosystem version management
Dependency Security Auditing
resources/security-scanning.md
Automated security scanning, vulnerability management, and supply chain security best practices.
- Automated tools (Dependabot, Snyk, GitHub Advanced Security)
- Running audits (npm audit, pip-audit, cargo audit)
- CI integration and alert configuration
- Incident response workflows
Dependency Selection
resources/dependency-selection-guide.md
Deciding whether to add a new dependency and choosing between similar packages.
- Minimal dependencies principle (best dependency is the one you don't add)
- Evaluation checklist (maintenance, bundle size, security, alternatives)
- Choosing between similar packages (comparison matrix)
- When to reject a dependency
Update Strategies
resources/update-strategies.md
Keeping dependencies up to date safely while minimizing breaking changes and security risks.
- Update strategies (continuous, scheduled, security-only)
- Safe update workflow (check outdated, categorize risk, test, deploy)
- Automated update tools (Dependabot, Renovate, npm-check-updates)
- Handling breaking changes and rollback plans
Monorepo Management
resources/monorepo-patterns.md
Managing multiple related packages in a single repository with shared dependencies.
- Workspace tools (pnpm, npm, yarn workspaces)
- Monorepo structure and organization
- Build optimization (Nx, Turborepo)
- Versioning and publishing strategies
Transitive Dependencies
resources/transitive-dependencies.md
Dealing with dependencies of your dependencies (indirect dependencies).
- Viewing dependency trees (npm ls, pnpm why, pipdeptree)
- Resolving transitive conflicts (overrides, resolutions, constraints)
- Security risks and version conflicts
- Best practices (use sparingly, document, test)
Ecosystem-Specific Guides
resources/ecosystem-guides.md
Language and package-manager-specific best practices.
- Node.js (npm, yarn, pnpm comparison and best practices)
- Python (pip, poetry, conda)
- Rust (cargo), Go (go mod), Java (maven, gradle)
- PHP (composer), .NET (nuget)
Anti-Patterns
resources/anti-patterns.md
Common mistakes to avoid when managing dependencies.
- Critical anti-patterns (not committing lockfiles, wildcards, ignoring audits)
- Dangerous anti-patterns (never updating, deprecated packages)
- Moderate anti-patterns (overusing overrides, ignoring peer deps)
Navigation: Templates
Node.js
templates/nodejs/
package-json-template.json - Production-ready package.json with best practicesnpmrc-template.txt - Team configuration for npmpnpm-workspace-template.yaml - Monorepo workspace setup
Python
templates/python/
pyproject-toml-template.toml - Poetry configuration with best practices
Automation
templates/automation/
dependabot-config.yml - GitHub Dependabot configurationrenovate-config.json - Renovate Bot configurationaudit-checklist.md - Security audit workflowtemplate-supply-chain-security.md - NEW SBOM, provenance, vulnerability managementtemplate-dependency-upgrade-playbook.md - Upgrade batching, rollout, rollbacktemplate-sbom-vuln-triage-checklist.md - SBOM mapping + vulnerability triage
Supply Chain Security
templates/automation/template-supply-chain-security.md — Production-grade dependency security.
Related templates:
- templates/automation/template-dependency-upgrade-playbook.md
- templates/automation/template-sbom-vuln-triage-checklist.md
Key Sections
- SBOM Generation — CycloneDX, SPDX formats; CI/CD integration
- Provenance & Attestation — SLSA levels, Sigstore signing, npm provenance
- Vulnerability Management — Triage workflow, severity SLAs, scanning tools
- Upgrade Playbooks — Batching strategy, rollback procedures
- Pinning & Reproducibility — Lockfiles, hash pinning, version constraints
Do / Avoid
GOOD: Do
- Generate SBOM for every release
- Sign release artifacts (Sigstore/cosign)
- Run vulnerability scans in CI/CD
- Fix critical vulnerabilities within 24 hours
- Use lockfiles for reproducible builds
- Verify npm package provenance
- Batch non-security updates by risk level
BAD: Avoid
- Publishing without SBOM
- Using unsigned packages in production
- Ignoring vulnerability scanner output
- Updating all dependencies at once
- Using wildcard version ranges (
*, >=)
- Committing without updating lockfile
- Bypassing security gates "just this once"
Anti-Patterns
| Anti-Pattern |
Problem |
Fix |
| No SBOM |
Can't respond to supply chain attacks |
Generate SBOM in CI/CD |
| Unsigned artifacts |
Tampering undetectable |
Sign with Sigstore |
| Floating versions |
Build not reproducible |
Use lockfiles + exact versions |
| All-at-once updates |
Hard to bisect regressions |
Batch by risk level |
| npm install in CI |
Non-deterministic |
Use npm ci |
| No audit gate |
Vulnerabilities ship to prod |
Gate deployments on audit |
Optional: AI/Automation
Note: AI assists with triage but security decisions need human judgment.
- Automated PR triage — Categorize dependency updates by risk
- Changelog summarization — Summarize breaking changes in updates
- Vulnerability correlation — Link CVEs to affected packages
Bounded Claims
- AI cannot determine business risk acceptance
- Automated fixes require security team review
- Vulnerability severity context needs human validation
Quick Decision Matrix
| Scenario |
Recommendation |
| Adding new dependency |
Check Bundlephobia, npm audit, weekly downloads, last commit |
| Updating dependencies |
Use npm outdated, update in batches, test in staging |
| Security vulnerability found |
Use npm audit fix, review CHANGELOG, test, deploy immediately |
| Monorepo setup |
Use pnpm workspaces or Nx/Turborepo for build caching |
| Transitive conflict |
Use overrides sparingly, document why, test thoroughly |
| Choosing package manager |
pnpm (fastest), npm (most compatible), yarn (good middle) |
| Python environment |
Poetry (apps), pip+venv (simple), conda (data science) |
Core Principles
1. Always Commit Lockfiles
Lockfiles ensure reproducible builds across environments. Never add them to .gitignore.
Exception: Don't commit Cargo.lock for Rust libraries (only for applications).
2. Use Semantic Versioning
Use caret (^) for most dependencies, exact versions for mission-critical, avoid wildcards (*).
{
"dependencies": {
"express": "^4.18.0", // Allows patches and minors
"critical-lib": "1.2.3" // Exact for critical
}
}
3. Audit Dependencies Regularly
Run security audits weekly, fix critical vulnerabilities immediately.
npm audit
npm audit fix
4. Minimize Dependencies
The best dependency is the one you don't add. Ask: Can I implement this in <100 LOC?
5. Update Regularly
Update monthly or quarterly. Don't let technical debt accumulate.
npm outdated
npm update
6. Use Overrides Sparingly
Only override transitive dependencies for security patches or conflicts. Document why.
{
"overrides": {
"axios": "1.6.0" // CVE-2023-xxxxx fix
}
}
Related Skills
For complementary workflows and deeper dives:
dev-api-design - API versioning strategies, dependency injection patternsgit-workflow - Git workflows for managing lockfile conflicts, branching strategiesqa-testing-strategy - Testing strategies for dependency updates, integration testingsoftware-security-appsec - OWASP Top 10, cryptography standards, authentication patternsops-devops-platform - CI/CD pipelines, Docker containerization, DevSecOps, deployment automationdocs-codebase - Documenting dependency choices, ADRs, changelogs
External Resources
See data/sources.json for 82 curated resources:
- Package managers: npm, pnpm, Yarn, pip, Poetry, Cargo, Go modules, Maven, Composer
- Semantic versioning: SemVer spec, version calculators, constraint references
- Security tools: Snyk, Dependabot, GitHub Advanced Security, OWASP Dependency-Check, pip-audit, cargo-audit, Socket.dev, Renovate
- Lockfile management: Official docs for package-lock.json, poetry.lock, Cargo.lock, pnpm-lock.yaml
- Monorepo tools: pnpm workspaces, npm workspaces, Yarn workspaces, Nx, Turborepo, Lerna, Bazel
- Analysis tools: Bundlephobia, npm-check-updates, depcheck, pipdeptree, cargo tree
- Supply chain security: SLSA framework, SBOM (CISA), Sigstore, npm provenance, OpenSSF Scorecard
- Best practices: npm/Poetry/Cargo guides, ACM Queue articles, dependency hell references
- Version management: nvm, pyenv, rustup, asdf
- Learning resources: npm guides, Python Packaging User Guide, Rust Book, Monorepo.tools
Usage Notes
For Claude:
- Use this skill when users need dependency management guidance
- Reference specific resources based on the task (lockfiles, security, updates)
- Provide ecosystem-specific guidance (Node.js, Python, Rust)
- Always recommend security audits and reproducible builds
- Encourage minimal dependencies and regular updates
- Link to templates for common configurations
Best Practices:
- Always commit lockfiles (except Cargo.lock for libraries)
- Use semantic versioning (caret for most deps, exact for critical)
- Audit dependencies weekly (
npm audit, pip-audit, cargo audit)
- Update dependencies monthly or quarterly (not all at once)
- Choose package manager based on project needs (pnpm for speed, Poetry for Python apps)
- Document dependency choices in ADRs (Architecture Decision Records)
Success Criteria: Dependencies are minimal, well-maintained, secure, reproducible across environments, and regularly audited for vulnerabilities.
1---2name: dev-dependency-management3description: Package and dependency management patterns across ecosystems (npm, pip, cargo, maven). Covers lockfiles, semantic versioning, dependency security scanning, update strategies, monorepo workspaces, transitive dependencies, and avoiding dependency hell.4---5
6# Dependency Management — Production Patterns
7
8**Modern Best Practices (2025)**: Lockfile-first workflows, automated security scanning (Dependabot, Snyk), semantic versioning, minimal dependencies principle, monorepo workspaces (pnpm, Nx), supply chain security (SBOM, signatures), and reproducible builds.
9
10---
11
12## When to Use This Skill
13
14Claude should invoke this skill when a user requests:
15
16- Adding new dependencies to a project
17- Updating existing dependencies safely
18- Resolving dependency conflicts or version mismatches
19- Auditing dependencies for security vulnerabilities
20- Understanding lockfile management and reproducible builds
21- Setting up monorepo workspaces (pnpm, npm, yarn)
22- Managing transitive dependencies and overrides
23- Choosing between similar packages (bundle size, maintenance, security)
24- Dependency version constraints and semantic versioning
25- Dependency security best practices and supply chain security
26- Troubleshooting "dependency hell" scenarios
27- Package manager configuration and optimization
28- Creating reproducible builds across environments
29
30---
31
32## Quick Reference
33
34| Task | Tool/Command | Key Action | When to Use |
35|------|--------------|------------|-------------|
36| **Install from lockfile** | `npm ci`, `poetry install`, `cargo build` | Clean install, reproducible | CI/CD, production deployments |
37| **Add dependency** | `npm install <pkg>`, `poetry add <pkg>` | Updates lockfile automatically | New feature needs library |
38| **Update dependencies** | `npm update`, `poetry update`, `cargo update` | Updates within version constraints | Monthly/quarterly maintenance |
39| **Check for vulnerabilities** | `npm audit`, `pip-audit`, `cargo audit` | Scans for known CVEs | Before releases, weekly |
40| **View dependency tree** | `npm ls`, `pnpm why`, `pipdeptree` | Shows transitive dependencies | Debugging conflicts |
41| **Override transitive dep** | `overrides` (npm), `pnpm.overrides` | Force specific version | Security patch, conflict resolution |
42| **Monorepo setup** | `pnpm workspaces`, `npm workspaces` | Shared dependencies, cross-linking | Multi-package projects |
43| **Check outdated** | `npm outdated`, `poetry show --outdated` | Lists available updates | Planning update sprints |
44
45---
46
47## Decision Tree: Dependency Management
48
49```text
50User needs: [Dependency Task]
51 ├─ Adding new dependency?
52 │ ├─ Check: Do I really need this? (Can implement in <100 LOC?)
53 │ ├─ Check: Is it well-maintained? (Last commit <6 months, >10k downloads/week)
54 │ ├─ Check: Bundle size impact? (Use Bundlephobia for JS)
55 │ ├─ Check: Security risks? (`npm audit`, Snyk)
56 │ └─ If all checks pass → Add with `npm install <pkg>` → Commit lockfile
57 │
58 ├─ Updating dependencies?
59 │ ├─ Security vulnerability? → `npm audit fix` → Test → Deploy immediately
60 │ ├─ Routine update?
61 │ ├─ Patch versions → `npm update` → Safe, do frequently
62 │ ├─ Minor/major → Check CHANGELOG → Test in staging → Update gradually
63 │ └─ All at once → [FAIL] RISKY → Update in batches instead
64 │
65 ├─ Dependency conflict?
66 │ ├─ Transitive dependency issue?
67 │ ├─ View tree: `npm ls <package>`
68 │ ├─ Use overrides sparingly: `overrides` in package.json
69 │ └─ Document why override is needed
70 │ └─ Peer dependency mismatch?
71 │ └─ Check version compatibility → Update parent or child
72 │
73 ├─ Monorepo project?
74 │ ├─ Use pnpm workspaces (fastest, best)
75 │ ├─ Shared deps → Root package.json
76 │ ├─ Package-specific → Package directories
77 │ └─ Use Nx or Turborepo for task caching
78 │
79 └─ Choosing package manager?
80 ├─ New project → **pnpm** (3x faster, 1/3 disk space)
81 ├─ Existing npm project → Migrate or stay (check team preference)
82 ├─ Python → **Poetry** (apps), pip+venv (simple)
83 └─ Data science → **conda** (environment management)
84```
85
86---
87
88## Navigation: Core Patterns
89
90### Lockfile Management
91
92**[`resources/lockfile-management.md`](resources/lockfile-management.md)**
93
94Lockfiles ensure reproducible builds by recording exact versions of all dependencies (direct + transitive). Essential for preventing "works on my machine" issues.
95
96- Golden rules (always commit, never edit manually, regenerate on changes)
97- Commands by ecosystem (npm ci, poetry install, cargo build)
98- Troubleshooting lockfile conflicts
99- CI/CD integration patterns
100
101### Semantic Versioning (SemVer)
102
103**[`resources/semver-guide.md`](resources/semver-guide.md)**
104
105Understanding version constraints (`^`, `~`, exact) and how to specify dependency ranges safely.
106
107- SemVer format (MAJOR.MINOR.PATCH)
108- Version constraint syntax (caret, tilde, exact)
109- Recommended strategies by project type
110- Cross-ecosystem version management
111
112### Dependency Security Auditing
113
114**[`resources/security-scanning.md`](resources/security-scanning.md)**
115
116Automated security scanning, vulnerability management, and supply chain security best practices.
117
118- Automated tools (Dependabot, Snyk, GitHub Advanced Security)
119- Running audits (npm audit, pip-audit, cargo audit)
120- CI integration and alert configuration
121- Incident response workflows
122
123### Dependency Selection
124
125**[`resources/dependency-selection-guide.md`](resources/dependency-selection-guide.md)**
126
127Deciding whether to add a new dependency and choosing between similar packages.
128
129- Minimal dependencies principle (best dependency is the one you don't add)
130- Evaluation checklist (maintenance, bundle size, security, alternatives)
131- Choosing between similar packages (comparison matrix)
132- When to reject a dependency
133
134### Update Strategies
135
136**[`resources/update-strategies.md`](resources/update-strategies.md)**
137
138Keeping dependencies up to date safely while minimizing breaking changes and security risks.
139
140- Update strategies (continuous, scheduled, security-only)
141- Safe update workflow (check outdated, categorize risk, test, deploy)
142- Automated update tools (Dependabot, Renovate, npm-check-updates)
143- Handling breaking changes and rollback plans
144
145### Monorepo Management
146
147**[`resources/monorepo-patterns.md`](resources/monorepo-patterns.md)**
148
149Managing multiple related packages in a single repository with shared dependencies.
150
151- Workspace tools (pnpm, npm, yarn workspaces)
152- Monorepo structure and organization
153- Build optimization (Nx, Turborepo)
154- Versioning and publishing strategies
155
156### Transitive Dependencies
157
158**[`resources/transitive-dependencies.md`](resources/transitive-dependencies.md)**
159
160Dealing with dependencies of your dependencies (indirect dependencies).
161
162- Viewing dependency trees (npm ls, pnpm why, pipdeptree)
163- Resolving transitive conflicts (overrides, resolutions, constraints)
164- Security risks and version conflicts
165- Best practices (use sparingly, document, test)
166
167### Ecosystem-Specific Guides
168
169**[`resources/ecosystem-guides.md`](resources/ecosystem-guides.md)**
170
171Language and package-manager-specific best practices.
172
173- Node.js (npm, yarn, pnpm comparison and best practices)
174- Python (pip, poetry, conda)
175- Rust (cargo), Go (go mod), Java (maven, gradle)
176- PHP (composer), .NET (nuget)
177
178### Anti-Patterns
179
180**[`resources/anti-patterns.md`](resources/anti-patterns.md)**
181
182Common mistakes to avoid when managing dependencies.
183
184- Critical anti-patterns (not committing lockfiles, wildcards, ignoring audits)
185- Dangerous anti-patterns (never updating, deprecated packages)
186- Moderate anti-patterns (overusing overrides, ignoring peer deps)
187
188---
189
190## Navigation: Templates
191
192### Node.js
193
194**[`templates/nodejs/`](templates/nodejs/)**
195
196- [`package-json-template.json`](templates/nodejs/package-json-template.json) - Production-ready package.json with best practices
197- `npmrc-template.txt` - Team configuration for npm
198- [`pnpm-workspace-template.yaml`](templates/nodejs/pnpm-workspace-template.yaml) - Monorepo workspace setup
199
200### Python
201
202**[`templates/python/`](templates/python/)**
203
204- [`pyproject-toml-template.toml`](templates/python/pyproject-toml-template.toml) - Poetry configuration with best practices
205
206### Automation
207
208**[`templates/automation/`](templates/automation/)**
209
210- [`dependabot-config.yml`](templates/automation/dependabot-config.yml) - GitHub Dependabot configuration
211- [`renovate-config.json`](templates/automation/renovate-config.json) - Renovate Bot configuration
212- [`audit-checklist.md`](templates/automation/audit-checklist.md) - Security audit workflow
213- **[`template-supply-chain-security.md`](templates/automation/template-supply-chain-security.md)** - **NEW** SBOM, provenance, vulnerability management
214- [`template-dependency-upgrade-playbook.md`](templates/automation/template-dependency-upgrade-playbook.md) - Upgrade batching, rollout, rollback
215- [`template-sbom-vuln-triage-checklist.md`](templates/automation/template-sbom-vuln-triage-checklist.md) - SBOM mapping + vulnerability triage
216
217---
218
219## Supply Chain Security
220
221**[templates/automation/template-supply-chain-security.md](templates/automation/template-supply-chain-security.md)** — Production-grade dependency security.
222
223Related templates:
224- [templates/automation/template-dependency-upgrade-playbook.md](templates/automation/template-dependency-upgrade-playbook.md)
225- [templates/automation/template-sbom-vuln-triage-checklist.md](templates/automation/template-sbom-vuln-triage-checklist.md)
226
227### Key Sections
228
229- **SBOM Generation** — CycloneDX, SPDX formats; CI/CD integration
230- **Provenance & Attestation** — SLSA levels, Sigstore signing, npm provenance
231- **Vulnerability Management** — Triage workflow, severity SLAs, scanning tools
232- **Upgrade Playbooks** — Batching strategy, rollback procedures
233- **Pinning & Reproducibility** — Lockfiles, hash pinning, version constraints
234
235### Do / Avoid
236
237#### GOOD: Do
238
239- Generate SBOM for every release
240- Sign release artifacts (Sigstore/cosign)
241- Run vulnerability scans in CI/CD
242- Fix critical vulnerabilities within 24 hours
243- Use lockfiles for reproducible builds
244- Verify npm package provenance
245- Batch non-security updates by risk level
246
247#### BAD: Avoid
248
249- Publishing without SBOM
250- Using unsigned packages in production
251- Ignoring vulnerability scanner output
252- Updating all dependencies at once
253- Using wildcard version ranges (`*`, `>=`)
254- Committing without updating lockfile
255- Bypassing security gates "just this once"
256
257### Anti-Patterns
258
259| Anti-Pattern | Problem | Fix |
260|--------------|---------|-----|
261| **No SBOM** | Can't respond to supply chain attacks | Generate SBOM in CI/CD |
262| **Unsigned artifacts** | Tampering undetectable | Sign with Sigstore |
263| **Floating versions** | Build not reproducible | Use lockfiles + exact versions |
264| **All-at-once updates** | Hard to bisect regressions | Batch by risk level |
265| **npm install in CI** | Non-deterministic | Use `npm ci` |
266| **No audit gate** | Vulnerabilities ship to prod | Gate deployments on audit |
267
268---
269
270## Optional: AI/Automation
271
272> **Note**: AI assists with triage but security decisions need human judgment.
273
274- **Automated PR triage** — Categorize dependency updates by risk
275- **Changelog summarization** — Summarize breaking changes in updates
276- **Vulnerability correlation** — Link CVEs to affected packages
277
278### Bounded Claims
279
280- AI cannot determine business risk acceptance
281- Automated fixes require security team review
282- Vulnerability severity context needs human validation
283
284---
285
286## Quick Decision Matrix
287
288| Scenario | Recommendation |
289|----------|----------------|
290| Adding new dependency | Check Bundlephobia, npm audit, weekly downloads, last commit |
291| Updating dependencies | Use `npm outdated`, update in batches, test in staging |
292| Security vulnerability found | Use `npm audit fix`, review CHANGELOG, test, deploy immediately |
293| Monorepo setup | Use **pnpm workspaces** or Nx/Turborepo for build caching |
294| Transitive conflict | Use `overrides` sparingly, document why, test thoroughly |
295| Choosing package manager | **pnpm** (fastest), npm (most compatible), yarn (good middle) |
296| Python environment | **Poetry** (apps), pip+venv (simple), conda (data science) |
297
298---
299
300## Core Principles
301
302### 1. Always Commit Lockfiles
303
304Lockfiles ensure reproducible builds across environments. Never add them to `.gitignore`.
305
306**Exception**: Don't commit `Cargo.lock` for Rust libraries (only for applications).
307
308### 2. Use Semantic Versioning
309
310Use caret (`^`) for most dependencies, exact versions for mission-critical, avoid wildcards (`*`).
311
312```json
313{
314 "dependencies": {
315 "express": "^4.18.0", // Allows patches and minors
316 "critical-lib": "1.2.3" // Exact for critical
317 }
318}
319```
320
321### 3. Audit Dependencies Regularly
322
323Run security audits weekly, fix critical vulnerabilities immediately.
324
325```bash
326npm audit
327npm audit fix
328```
329
330### 4. Minimize Dependencies
331
332The best dependency is the one you don't add. Ask: Can I implement this in <100 LOC?
333
334### 5. Update Regularly
335
336Update monthly or quarterly. Don't let technical debt accumulate.
337
338```bash
339npm outdated
340npm update
341```
342
343### 6. Use Overrides Sparingly
344
345Only override transitive dependencies for security patches or conflicts. Document why.
346
347```json
348{
349 "overrides": {
350 "axios": "1.6.0" // CVE-2023-xxxxx fix
351 }
352}
353```
354
355---
356
357## Related Skills
358
359For complementary workflows and deeper dives:
360
361- [`dev-api-design`](../dev-api-design/SKILL.md) - API versioning strategies, dependency injection patterns
362- [`git-workflow`](../git-workflow/SKILL.md) - Git workflows for managing lockfile conflicts, branching strategies
363- [`qa-testing-strategy`](../qa-testing-strategy/SKILL.md) - Testing strategies for dependency updates, integration testing
364- [`software-security-appsec`](../software-security-appsec/SKILL.md) - OWASP Top 10, cryptography standards, authentication patterns
365- [`ops-devops-platform`](../ops-devops-platform/SKILL.md) - CI/CD pipelines, Docker containerization, DevSecOps, deployment automation
366- [`docs-codebase`](../docs-codebase/SKILL.md) - Documenting dependency choices, ADRs, changelogs
367
368---
369
370## External Resources
371
372See [`data/sources.json`](data/sources.json) for 82 curated resources:
373
374- **Package managers**: npm, pnpm, Yarn, pip, Poetry, Cargo, Go modules, Maven, Composer
375- **Semantic versioning**: SemVer spec, version calculators, constraint references
376- **Security tools**: Snyk, Dependabot, GitHub Advanced Security, OWASP Dependency-Check, pip-audit, cargo-audit, Socket.dev, Renovate
377- **Lockfile management**: Official docs for package-lock.json, poetry.lock, Cargo.lock, pnpm-lock.yaml
378- **Monorepo tools**: pnpm workspaces, npm workspaces, Yarn workspaces, Nx, Turborepo, Lerna, Bazel
379- **Analysis tools**: Bundlephobia, npm-check-updates, depcheck, pipdeptree, cargo tree
380- **Supply chain security**: SLSA framework, SBOM (CISA), Sigstore, npm provenance, OpenSSF Scorecard
381- **Best practices**: npm/Poetry/Cargo guides, ACM Queue articles, dependency hell references
382- **Version management**: nvm, pyenv, rustup, asdf
383- **Learning resources**: npm guides, Python Packaging User Guide, Rust Book, Monorepo.tools
384
385---
386
387## Usage Notes
388
389**For Claude:**
390
391- Use this skill when users need dependency management guidance
392- Reference specific resources based on the task (lockfiles, security, updates)
393- Provide ecosystem-specific guidance (Node.js, Python, Rust)
394- Always recommend security audits and reproducible builds
395- Encourage minimal dependencies and regular updates
396- Link to templates for common configurations
397
398**Best Practices:**
399
400- Always commit lockfiles (except Cargo.lock for libraries)
401- Use semantic versioning (caret for most deps, exact for critical)
402- Audit dependencies weekly (`npm audit`, `pip-audit`, `cargo audit`)
403- Update dependencies monthly or quarterly (not all at once)
404- Choose package manager based on project needs (pnpm for speed, Poetry for Python apps)
405- Document dependency choices in ADRs (Architecture Decision Records)
406
407---
408
409> **Success Criteria:** Dependencies are minimal, well-maintained, secure, reproducible across environments, and regularly audited for vulnerabilities.
majiayu000