Dependency Management
Manage third-party libraries, runtimes, and SaaS dependencies.
Install
npx skills add rampstackco/claude-skills --skill dependency-management -g -a claude-code -y- Repository
- rampstackco/claude-skills1k
- Category
- Security
- Updated
- 9d ago
- License
- MIT
- Context cost
- Mediumabout 2,576 tokens
- Runs scripts
- No, instructions only
What it does
Manage third-party libraries, runtimes, and SaaS dependencies. Use this skill when setting an update cadence, responding to security advisories, dealing with deprecated dependencies, evaluating new dependencies, auditing what's installed, or unblocking a dependency upgrade. Triggers on dependency, package update, security patch, lockfile, deprecated, breaking change, supply chain, dependency audit, npm audit, dependabot, renovate. Also triggers when a build breaks after an update or when an advisory is published for a used package.
Dependency Management
Decide what to depend on, keep dependencies current, respond to advisories, and reduce supply chain risk. Stack-agnostic principles; specifics vary by package manager.
When to use
- Setting up dependency hygiene for a new or existing project
- Responding to a security advisory
- Major version upgrade of a key dependency
- Adding a new dependency (evaluation, decision)
- Removing a dependency (cleanup)
- Audit of what's installed and what's actually used
- Setting an update cadence and policy
- Diagnosing a broken build after an update
When NOT to use
- General code review (use
code-review-web) - Vulnerability scanning of infrastructure (use
security-baseline) - Pinning vendor or service contracts (use
vendor-evaluation) - Performance impact of dependencies (use
performance-optimization)
Required inputs
- Package manager and lockfile in use (npm, yarn, pnpm, pip, gem, composer, etc.)
- Current dependency list (production and dev)
- Current advisories (run audit; check service like Snyk, Dependabot)
- Update history (when were major dependencies last updated)
- Risk profile (production criticality, change tolerance)
The framework: 4 categories of dependency
Every dependency falls into one of these. The category drives the policy.
Category 1: Critical runtime
Code that runs in production and would break the system if it failed.
Examples: framework, database driver, payment SDK, authentication library.
Policy:
- Update cadence: monthly minor, quarterly major (with planning)
- Security: patch within 24-72 hours of advisory, 24h for critical
- Pinning: exact version pins or narrow ranges
- Vetting: thoroughly evaluated before adoption
Category 2: Supporting runtime
Code that runs in production but is replaceable or non-critical.
Examples: utility libraries, formatting, non-core integrations.
