askill
dependency-manager

dependency-managerSafety 95Repository

Expert at package management and supply chain security. Use when managing dependencies, updating packages, resolving version conflicts, ensuring supply chain security, or auditing vulnerabilities in project dependencies.

21 stars
1.2k downloads
Updated 1/16/2026

Package Files

Loading files...
SKILL.md

Dependency Manager

Purpose

Provides expertise in package management, version resolution, and software supply chain security. Handles dependency updates, vulnerability auditing, and conflict resolution across multiple package ecosystems.

When to Use

  • Updating project dependencies
  • Resolving version conflicts
  • Auditing for security vulnerabilities
  • Managing lockfiles and reproducibility
  • Migrating between package managers
  • Implementing dependency policies
  • Reducing bundle size via dependency analysis

Quick Start

Invoke this skill when:

  • Updating project dependencies
  • Resolving version conflicts
  • Auditing for security vulnerabilities
  • Managing lockfiles and reproducibility
  • Implementing dependency policies

Do NOT invoke when:

  • Building CI/CD pipelines (use devops-engineer)
  • Publishing packages to registries (use build-engineer)
  • Container image management (use kubernetes-specialist)
  • Cloud infrastructure dependencies (use terraform-engineer)

Decision Framework

Update Strategy:
├── Security patch → Update immediately
├── Bug fix (patch) → Update with tests
├── Minor version → Review changelog, test
├── Major version → Full compatibility review
└── Deprecated package → Find replacement

Ecosystem Tools:
├── Node.js → npm, yarn, pnpm
├── Python → pip, poetry, uv
├── Go → go mod
├── Rust → cargo
├── Java → Maven, Gradle
└── .NET → NuGet

Core Workflows

1. Dependency Audit

  1. Run package audit tool
  2. Review vulnerability reports
  3. Prioritize by severity (CVSS)
  4. Check for available patches
  5. Update or find alternatives
  6. Verify fixes don't break app
  7. Document remediation

2. Major Version Upgrade

  1. Read changelog and migration guide
  2. Check for breaking changes
  3. Update in isolated branch
  4. Run full test suite
  5. Fix breaking changes
  6. Review for deprecated APIs
  7. Deploy to staging first

3. Lockfile Management

  1. Ensure lockfile is committed
  2. Use CI to verify lockfile matches
  3. Regenerate on conflict resolution
  4. Audit lockfile for tampering
  5. Update lockfile atomically

Best Practices

  • Always use lockfiles for reproducibility
  • Run security audits in CI/CD
  • Pin exact versions in production
  • Use renovate/dependabot for automation
  • Audit transitive dependencies
  • Minimize dependency count

Anti-Patterns

Anti-PatternProblemCorrect Approach
No lockfileNon-reproducible buildsCommit lockfiles
Ignoring auditsSecurity vulnerabilitiesAddress all high/critical
Auto-merge updatesBreaking changes in prodTest before merge
Too many depsLarge attack surfaceAudit and minimize
Outdated depsMissing security patchesRegular update cadence

Install

Download ZIP
Requires askill CLI v1.0+

AI Quality Score

90/100Analyzed 2/20/2026

High-quality skill document for dependency management. Provides comprehensive coverage of package management, version resolution, and supply chain security with clear decision frameworks, multiple core workflows, and practical anti-patterns. Well-structured with tags, ecosystem coverage (Node, Python, Go, Rust, Java, .NET), and explicit usage guidance. Scores high on all dimensions - highly actionable, clear, complete, reusable, and safe. Not internal-only; suitable for general use.

95
90
90
85
90

Metadata

Licenseunknown
Version-
Updated1/16/2026
Publisher404kidwiz

Tags

ci-cdsecuritytesting