Dependency Management

Dependency Management

Table of Contents

• Overview
• When to Use
• Quick Start
• Reference Guides
• Best Practices

Overview

Comprehensive dependency management across JavaScript/Node.js, Python, Ruby, Java, and other ecosystems. Covers version control, conflict resolution, security auditing, and best practices for maintaining healthy dependencies.

When to Use

• Installing or updating project dependencies
• Resolving version conflicts
• Auditing security vulnerabilities
• Managing lock files (package-lock.json, Gemfile.lock, etc.)
• Implementing semantic versioning
• Setting up monorepo dependencies
• Optimizing dependency trees
• Managing peer dependencies

Quick Start

Minimal working example:

# Initialize projectnpm init -y
# Install dependenciesnpm install expressnpm install --save-dev jestnpm install --save-exact lodash  # Exact version
# Update dependenciesnpm updatenpm outdated  # Check for outdated packages
# Audit securitynpm auditnpm audit fix
# Clean install from lock filenpm ci  # Use in CI/CD
# View dependency treenpm listnpm list --depth=0  # Top-level only

Reference Guides

Detailed implementations in the references/ directory:

Best Practices

✅ DO

• Commit lock files to version control
• Use npm ci or equivalent in CI/CD pipelines
• Regular dependency audits (weekly/monthly)
• Keep dependencies up-to-date (automate with Dependabot)
• Use exact versions for critical dependencies
• Document why specific versions are pinned
• Test after updating dependencies
• Use semantic versioning correctly
• Minimize dependency count
• Review dependency licenses

❌ DON'T

• Manually edit lock files
• Mix package managers (npm + yarn in same project)
• Use npm install in CI/CD (use npm ci)
• Ignore security vulnerabilities
• Use wildcards (*) for versions
• Install packages globally when local install is possible
• Commit node_modules to git
• Use latest tag in production
• Blindly run npm audit fix
• Install unnecessary dependencies