Dependency Management

Workflows

• Audit: Check for known vulnerabilities
• Update: Keep dependencies reasonably current
• Lock: Ensure reproducible builds
• Minimize: Remove unused dependencies

Security Scanning

# Node.js
npm audit
pnpm audit

# Python
pip-audit
safety check

# Go
govulncheck ./...

# Rust
cargo audit

Version Management

Semantic Versioning

• Major (1.0.0): Breaking changes
• Minor (0.1.0): New features, backward compatible
• Patch (0.0.1): Bug fixes, backward compatible

Version Constraints

// package.json
{
  "dependencies": {
    "exact": "1.2.3",        // Exactly 1.2.3
    "patch": "~1.2.3",       // 1.2.x (patch updates)
    "minor": "^1.2.3",       // 1.x.x (minor updates)
    "range": ">=1.2.3 <2.0.0" // Range
  }
}

Lockfiles

Always commit lockfiles for reproducible builds:

• package-lock.json or pnpm-lock.yaml (Node.js)
• poetry.lock or uv.lock (Python)
• go.sum (Go)
• Cargo.lock (Rust)

Best Practices

1. Pin Versions in Production: Use exact versions or lockfiles
2. Update Regularly: Don’t let dependencies get too stale
3. Review Changelogs: Check breaking changes before major updates
4. Test After Updates: Run full test suite after dependency changes
5. Minimize Dependencies: Each dependency is a liability

Removing Unused Dependencies

# Node.js
npx depcheck

# Python
pip-autoremove

# Go
go mod tidy