Skip to content

dependency-management.md

Latest commit

 

History

History
40 lines (34 loc) · 2.15 KB

dependency-management.md

File metadata and controls

40 lines (34 loc) · 2.15 KB

Dependency Management

Version Pinning

  • Pin exact versions in applications: "lodash": "4.17.21" not "^4.17.21".
  • Use ranges in libraries to avoid peer dependency conflicts: "react": "^18.0.0".
  • Commit lockfiles (package-lock.json, pnpm-lock.yaml, Pipfile.lock, Cargo.lock) to version control.
  • Never run npm install or pip install without updating the lockfile.

Adding Dependencies

  • Check the package before adding: maintenance status, download count, open issues, last publish date.
  • Prefer packages with zero or few transitive dependencies.
  • Avoid packages that duplicate functionality already in the project or standard library.
  • Document the reason for adding each dependency in the commit message.
  • Prefer well-known packages: zod over yup, date-fns over moment, got over request.

Auditing

  • Run npm audit, pip audit, or cargo audit on every CI build.
  • Fail the build on critical or high severity vulnerabilities.
  • Use Dependabot or Renovate for automated dependency update PRs.
  • Review Dependabot PRs weekly. Do not let them accumulate.
  • Track known vulnerabilities in a security dashboard (Snyk, GitHub Security Advisories).

Update Policies

  • Critical security patches: apply within 24 hours.
  • High security patches: apply within 7 days.
  • Major version updates: evaluate quarterly. Test in a branch before merging.
  • Minor and patch updates: batch monthly. Run full test suite before merging.
  • Framework upgrades (React, Next.js, Django): plan as a dedicated task with migration guide review.

Monorepo Dependencies

  • Use workspace protocol (workspace:*) for internal package references.
  • Hoist common dependencies to the root package.json to avoid duplication.
  • Use peerDependencies for packages shared across workspace packages.
  • Run pnpm dedupe or npm dedupe after major dependency changes.

License Compliance

  • Maintain an approved license list: MIT, Apache-2.0, BSD-2-Clause, BSD-3-Clause, ISC.
  • Flag GPL, AGPL, and SSPL dependencies for legal review before use.
  • Run license checks in CI using license-checker or pip-licenses.
  • Document any license exceptions in LICENSE-EXCEPTIONS.md.