dependency-management

1# Dependency Management
2 
3Decide what to depend on, keep dependencies current, respond to advisories, and reduce supply chain risk. Stack-agnostic principles; specifics vary by package manager.
4 
5---
6 
7## When to use
8 
9- Setting up dependency hygiene for a new or existing project
10- Responding to a security advisory
11- Major version upgrade of a key dependency
12- Adding a new dependency (evaluation, decision)
13- Removing a dependency (cleanup)
14- Audit of what's installed and what's actually used
15- Setting an update cadence and policy
16- Diagnosing a broken build after an update
17 
18## When NOT to use
19 
20- General code review (use `code-review-web`)
21- Vulnerability scanning of infrastructure (use `security-baseline`)
22- Pinning vendor or service contracts (use `vendor-evaluation`)
23- Performance impact of dependencies (use `performance-optimization`)
24 
25---
26 
27## Required inputs
28 
29- Package manager and lockfile in use (npm, yarn, pnpm, pip, gem, composer, etc.)
30- Current dependency list (production and dev)
31- Current advisories (run audit; check service like Snyk, Dependabot)
32- Update history (when were major dependencies last updated)
33- Risk profile (production criticality, change tolerance)
34 
35---
36 
37## The framework: 4 categories of dependency
38 
39Every dependency falls into one of these. The category drives the policy.
40 
41### Category 1: Critical runtime
42 
43Code that runs in production and would break the system if it failed.
44 
45Examples: framework, database driver, payment SDK, authentication library.
46…