菜单
Version updates (major/minor/patch), security patch application, transitive dependency resolution, monorepo dependency management, deprecation tracking, license compliance. Use when updating dependencies, managing versions, or addressing CVEs.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Break a plan, spec, or PRD into independently-grabbable issues on the project issue tracker using tracer-bullet vertical slices.
Turn the current conversation into a PRD and publish it to the project issue tracker — no interview, just synthesis of what you've already discussed.
This skill should be used when implementing code quality standards, setting up linting/testing/security scans, enforcing coverage thresholds, or establishing CI/CD guardrails.
REST/gRPC API design, versioning strategies, error codes, request/response contracts, backward compatibility, rate limiting, OpenAPI specifications. Use when designing APIs, defining contracts, planning versioning, or ensuring API consistency.
This skill should be used when the user asks to "design a system", "architecture", "ADR", "system design", "tech stack", "choose between approaches", "coupling", "service granularity", "blueprint", "component design", "API contract", "schema design", "trade-offs", or discusses "monolith", "microservices", "fitness functions", or architectural decisions.
This skill should be used when the user mentions keywords related to cicd.
| name | dependency-management |
| description | Version updates (major/minor/patch), security patch application, transitive dependency resolution, monorepo dependency management, deprecation tracking, license compliance. Use when updating dependencies, managing versions, or addressing CVEs. |
| version | 1.0.0 |
Stay current. Stay secure. Minimize version mismatch.
Semantic Versioning:
1.0.0 → 2.0.0: Breaking change (test, update code)1.0.0 → 1.1.0: New feature (backward-compatible, usually safe)1.0.0 → 1.0.1: Bug fix (safe to update)# 1. Check for vulnerabilities
npm audit # or pip check, cargo audit
# 2. Update vulnerable packages
npm update lodash@4.17.21
# 3. Test changes
npm test
# 4. Commit & push
git commit -m "fix(deps): update lodash to patch CVE-2021-23337"
app → requests@2.28.0
app → urllib3@1.26.0
app → certifi@2022.9.24
requests → urllib3@1.25.0 # Different version!
Solution: Lock files (requirements.txt, package-lock.json, Cargo.lock)
Shared dependencies (lock once):
root/
Cargo.lock # All crates use this
crates/
auth/
api/
db/
# Checklist when you deprecate something
- [ ] Announce (email, docs, header warning)
- [ ] Timeline (6 months warning)
- [ ] Alternatives (what should users use?)
- [ ] Test (ensure new way works)
- [ ] Remove (after timeline)
Status: Ready for dependency work
Best for: Version updates, security patches, CVE management