القائمة
Dependency management across npm, pip, cargo, and maven. Use when managing lockfiles, security scanning, versioning, or monorepo workspaces.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
استنادا إلى تصنيف SOC المهني
Builds multi-repo context hubs and compiled markdown knowledge maps. Use when profiling repo portfolios or assembling LLM-ready cross-repo knowledge bases.
Builds per-repo code graphs in JSON and markdown-ready derived artifacts. Use when you need blast radius, symbol-level maps, import graphs, inheritance, or test links.
Context-driven AI development with AGENTS.md, repo knowledge bases, Claude Code, Codex, and Copilot. Use when adopting repo-native AI workflows or multi-repo setups.
Technical writing for READMEs, ADRs, API docs, and changelogs. Use when revising or consolidating a repo documentation folder.
Design, implement, and troubleshoot NUKE-based CI/CD pipelines for .NET services with fast local-to-CI feedback loops. Use when creating or refactoring `nuke/Build.cs` target graphs, tuning `DependsOn`/`After`/`Triggers`/`OnlyWhenDynamic` behavior, orchestrating unit/API/DB test categories, merging and publishing coverage and test reports, building and pushing Docker images with traceable tags and digests, producing artifact contracts such as `deploy.env`, and diagnosing flaky or slow pipeline execution. For service code changes use $software-csharp-backend, for NUnit fixture design use $qa-testing-nunit, and for safe logging rewrites use $dev-structured-logs.
Systematic debugging for crashes, regressions, flakes, and production bugs. Use when diagnosing stack traces, logs, traces, or profiling data.
| name | dev-dependency-management |
| description | Dependency management across npm, pip, cargo, and maven. Use when managing lockfiles, security scanning, versioning, or monorepo workspaces. |
Modern Best Practices (January 2026): Lockfile-first workflows, automated security scanning (Dependabot, Snyk, Socket.dev), semantic versioning, minimal dependencies principle, monorepo workspaces (pnpm, Nx, Turborepo), supply chain security (SBOM, AI BOM, Sigstore), reproducible builds, and AI-generated code validation.
The agent should invoke this skill when a user requests:
| Task | Tool/Command | Key Action | When to Use |
|---|---|---|---|
| Install from lockfile | npm ci, poetry install, cargo build | Clean install, reproducible | CI/CD, production deployments |
| Add dependency | npm install <pkg>, poetry add <pkg> | Updates lockfile automatically | New feature needs library |
| Update dependencies | npm update, poetry update, cargo update | Updates within version constraints | Monthly/quarterly maintenance |
| Check for vulnerabilities | npm audit, pip-audit, cargo audit | Scans for known CVEs | Before releases, weekly |
| View dependency tree | npm ls, pnpm why, pipdeptree | Shows transitive dependencies | Debugging conflicts |
| Override transitive dep | overrides (npm), pnpm.overrides | Force specific version | Security patch, conflict resolution |
| Monorepo setup | pnpm workspaces, npm workspaces | Shared dependencies, cross-linking | Multi-package projects |
| Check outdated | npm outdated, poetry show --outdated | Lists available updates | Planning update sprints |
User needs: [Dependency Task]
├─ Adding new dependency?
│ ├─ Check: Do I really need this? (Can implement in <100 LOC?)
│ ├─ Check: Is it well-maintained? (Last commit <6 months, >10k downloads/week)
│ ├─ Check: Bundle size impact? (Use Bundlephobia for JS)
│ ├─ Check: Security risks? (`npm audit`, Snyk)
│ └─ If all checks pass → Add with `npm install <pkg>` → Commit lockfile
│
├─ Updating dependencies?
│ ├─ Security vulnerability? → `npm audit fix` → Test → Deploy immediately
│ ├─ Routine update?
│ ├─ Patch versions → `npm update` → Safe, do frequently
│ ├─ Minor/major → Check CHANGELOG → Test in staging → Update gradually
│ └─ All at once → [FAIL] RISKY → Update in batches instead
│
├─ Dependency conflict?
│ ├─ Transitive dependency issue?
│ ├─ View tree: `npm ls <package>`
│ ├─ Use overrides sparingly: `overrides` in package.json
│ └─ Document why override is needed
│ └─ Peer dependency mismatch?
│ └─ Check version compatibility → Update parent or child
│
├─ Monorepo project?
│ ├─ Use pnpm workspaces (recommended default)
│ ├─ Shared deps → Root package.json
│ ├─ Package-specific → Package directories
│ └─ Use Nx or Turborepo for task caching
│
└─ Choosing package manager?
├─ New JS project → **pnpm** (recommended default) or **Bun** (often faster; verify ecosystem maturity)
├─ Enterprise monorepo → **pnpm** (mature workspace support)
├─ Speed-focused experimentation → **Bun** (verify ecosystem maturity)
├─ Existing npm project → Migrate to pnpm or stay (check team preference)
├─ Python → **uv** (fast), Poetry (mature), pip+venv (simple)
└─ Data science → **conda** or **uv** (faster environment setup)
references/lockfile-management.md
Lockfiles ensure reproducible builds by recording exact versions of all dependencies (direct + transitive). Essential for preventing "works on my machine" issues.
Understanding version constraints (^, ~, exact) and how to specify dependency ranges safely.
references/security-scanning.md
Automated security scanning, vulnerability management, and supply chain security best practices.
references/dependency-selection-guide.md
Deciding whether to add a new dependency and choosing between similar packages.
references/update-strategies.md
Keeping dependencies up to date safely while minimizing breaking changes and security risks.
references/monorepo-patterns.md
Managing multiple related packages in a single repository with shared dependencies.
references/transitive-dependencies.md
Dealing with dependencies of your dependencies (indirect dependencies).
references/ecosystem-guides.md
Language and package-manager-specific best practices.
Common mistakes to avoid when managing dependencies.
references/container-dependency-patterns.md
Managing dependencies in containerized environments (Docker, OCI).
references/version-conflict-resolution.md
Systematic approaches to resolving dependency version conflicts.
references/license-compliance.md
Open-source license management and compliance automation.
package-json-template.json - Production-ready package.json with best practicesnpmrc-template.txt - Team configuration for npmpnpm-workspace-template.yaml - Monorepo workspace setuppyproject-toml-template.toml - Poetry configuration with best practicesdependabot-config.yml - GitHub Dependabot configurationrenovate-config.json - Renovate Bot configurationaudit-checklist.md - Security audit workflowtemplate-supply-chain-security.md - NEW SBOM, provenance, vulnerability managementtemplate-dependency-upgrade-playbook.md - Upgrade batching, rollout, rollbacktemplate-sbom-vuln-triage-checklist.md - SBOM mapping + vulnerability triageassets/automation/template-supply-chain-security.md — Production-grade dependency security covering SBOM generation (CycloneDX/SPDX), provenance and attestation (SLSA, Sigstore), vulnerability management SLAs, upgrade playbooks, and EU Cyber Resilience Act requirements.
Key rules: generate SBOM per release, sign artifacts (Sigstore/cosign), run audit scans in CI, fix critical CVEs within 24 hours, use npm ci (never npm install) in pipelines, batch non-security updates by risk level.
Related templates:
WARNING: AI coding agents can introduce vulnerable or non-existent packages at scale (Endor Labs, 2025).
AI tools accelerate coding but introduce supply chain risks:
| Do | Don't |
|---|---|
| Treat AI-generated code as untrusted third-party input | Blindly accept AI dependency suggestions |
| Enforce same SAST/SCA scanning for AI-generated code | Skip security review for "AI-written" code |
| Verify all AI-suggested packages actually exist | Trust AI to know current package versions |
| Integrate security tools into AI workflows (MCP) | Allow AI to add dependencies without review |
| Vet MCP servers as part of supply chain | Use unvetted AI integrations |
Before accepting AI-suggested dependencies:
npm audit / pip-audit shows no vulnerabilitiesNote: AI assists with triage but security decisions need human judgment.
| Scenario | Recommendation |
|---|---|
| Adding new dependency | Check Bundlephobia, npm audit, weekly downloads, last commit |
| Updating dependencies | Use npm outdated, update in batches, test in staging |
| Security vulnerability found | Use npm audit fix, review CHANGELOG, test, deploy immediately |
| Monorepo setup | Use pnpm workspaces or Nx/Turborepo for build caching |
| Transitive conflict | Use overrides sparingly, document why, test thoroughly |
| Choosing JS package manager | pnpm (fastest, disk-efficient), Bun (7× faster), npm (most compatible) |
| Python environment | uv (10-100× faster), Poetry (mature), pip+venv (simple), conda (data science) |
Lockfiles ensure reproducible builds across environments. Never add them to .gitignore.
Exception: Don't commit Cargo.lock for Rust libraries (only for applications).
Use caret (^) for most dependencies, exact versions for mission-critical, avoid wildcards (*). See references/semver-guide.md for constraint syntax and strategies.
Run npm audit / pip-audit / cargo audit weekly; fix critical vulnerabilities immediately. See references/security-scanning.md.
The best dependency is the one you don't add. Ask: Can I implement this in <100 LOC? See references/dependency-selection-guide.md.
Update monthly or quarterly in batches — do not update all at once. See references/update-strategies.md.
Only override transitive dependencies for security patches or conflicts. Document why in a comment (// CVE-2023-xxxxx fix). See references/transitive-dependencies.md.
For complementary workflows and deeper dives:
dev-api-design - API versioning strategies, dependency injection patternsdev-git-workflow - Git workflows for managing lockfile conflicts, branching strategiesqa-testing-strategy - Testing strategies for dependency updates, integration testingsoftware-security-appsec - OWASP Top 10, cryptography standards, authentication patternsops-devops-platform - CI/CD pipelines, Docker containerization, DevSecOps, deployment automationdocs-codebase - Documenting dependency choices, ADRs, changelogsSee data/sources.json for curated resources:
For Codex / Claude Code:
Best Practices:
npm audit, pip-audit, cargo audit)Success Criteria: Dependencies are minimal, well-maintained, secure, reproducible across environments, and regularly audited for vulnerabilities.
IMPORTANT: When users ask recommendation questions about package managers, dependency tools, or supply chain security, you MUST use WebSearch to check current trends before answering.
"dependency management best practices 2026""[specific tool] vs alternatives 2026""supply chain security trends January 2026""[package manager] features 2026"After searching, provide:
Run this before build/test/edit loops to prevent avoidable churn such as next: command not found.
# 1) Runtime + package manager sanity
node -v
npm -v
# 2) Lockfile and install mode
ls -1 package-lock.json pnpm-lock.yaml yarn.lock 2>/dev/null
test -d node_modules || npm ci
# 3) Verify framework binaries resolve
npx next --version 2>/dev/null || echo "next missing"
npx eslint --version 2>/dev/null || echo "eslint missing"
# 4) Surface dependency graph issues early
npm ls --depth=0
npm ci, pnpm install --frozen-lockfile, etc).