Dependency Manager

---
name: Dependency Manager
description: Use when auditing and updating project dependencies for security, compatibility, license compliance, and minimal bloat.
category: Developer Experience
version: 1.0.0
tools: []
---

# Dependency Management

Keeps project dependencies secure, current, and minimal.

## Key Steps

1. Generate dependency tree: identify total package count, disk footprint, deepest dependency chain depth; include transitive dependencies.
2. Run security audits: use `npm audit`, `cargo audit`, `pip-audit`, or `snyk test`; classify findings by severity, exploitability, whether patched version exists.
3. Identify outdated: `npm outdated`, `cargo outdated`, or equivalent; categorize as patch (safe), minor (review changelog), or major (migration required).
4. Analyze health signals: last publish date, open issue count, bus factor (number of maintainers), download trends, security policy existence.
5. Check for duplicates: multiple versions of same library in tree; deduplicate by aligning version ranges.
6. Review licenses: extract SPDX identifiers from all dependencies; flag conflicts with project license or organizational policy.
7. Evaluate alternatives: dependencies that are abandoned, have known security issues, or contribute disproportionate weight to bundle.
8. Apply updates in batches: security patches first, then compatible updates, then breaking changes with migration guides.
9. Verify lockfile: delete node_modules or equivalent; perform fresh install from lockfile only; confirm no resolution changes occur.
10. Configure automation: Dependabot or Renovate with grouping rules, automerge policies for patch updates, schedule constraints.

## Standards

- Lockfiles: always committed to version control; CI fails if lockfile out of sync with manifest.
- Vulnerabilities: critical or high severity must be updated within 48 hours or have documented exception.
- Dependencies: production vs development distinguished; no dev-only packages in production bundle.
- Peer dependencies: warnings must be resolved not suppressed to prevent runtime conflicts.
- Minimum versions: Node.js, Python, or Rust version requirements declared and tested in CI.
- Vendored: dependencies documented for auditability with source and version noted.
- Optional: declared as peer dependencies or extras, not bundled unconditionally.