39 lines
1.9 KiB
Markdown
39 lines
1.9 KiB
Markdown
|
---
|
||
|
|
name: deps
|
||
|
|
description: Manage dependencies: choosing, adding, updating, or removing them. Use when evaluating a library, resolving a version conflict, pruning unused deps, or hardening the supply chain.
|
||
|
|
---
|
||
|
|
|
||
|
|
# Dependencies
|
||
|
|
|
||
|
|
Every dependency is code you did not write but now maintain. Add deliberately, prune regularly.
|
||
|
|
|
||
|
|
## Choose on maintenance, not features
|
||
|
|
|
||
|
|
Before adding: is it actively maintained (recent commits, responsive issues), widely used, and
|
||
|
|
small enough to be worth it? A dependency that saves a day and is abandoned in a year costs a
|
||
|
|
week. For something small and stable, a dozen lines in your own codebase often beats a package.
|
||
|
|
|
||
|
|
## Pin and lock
|
||
|
|
|
||
|
|
Exact versions in the manifest for anything that matters, a lockfile committed, and installs
|
||
|
|
that respect it. A `^` range means your build tomorrow differs from your build today. The
|
||
|
|
lockfile is the build's memory; do not delete it to "fix" a conflict — resolve the conflict.
|
||
|
|
|
||
|
|
## Update on a schedule, read the changelog
|
||
|
|
|
||
|
|
Routine small updates beat a yearly painful one. For a major bump: read the changelog and the
|
||
|
|
migration guide, find every call site of the changed API, and apply one shape of change (see
|
||
|
|
the migrate skill). Update one thing at a time so a regression has an obvious cause.
|
||
|
|
|
||
|
|
## Know your transitive tree
|
||
|
|
|
||
|
|
A direct dependency drags in dozens of transitive ones. Audit the tree for: known
|
||
|
|
vulnerabilities (`audit`/SCA tooling), abandoned packages deep in it, and duplicate copies of
|
||
|
|
the same library at different versions bloating the bundle. Remove what you no longer use — an
|
||
|
|
unused dependency is attack surface and install time for nothing.
|
||
|
|
|
||
|
|
## Supply chain is a trust decision
|
||
|
|
|
||
|
|
A package runs its install scripts with your permissions. Prefer packages with provenance and a
|
||
|
|
reproducible build, be wary of sudden ownership transfers, and pin so a hijacked publish does
|
||
|
|
not reach you automatically. The lockfile is also your audit trail of exactly what shipped.
|