Dependency Lifecycle Skill

Goal

Produce a dependency lifecycle policy that keeps a project's third-party dependencies current, supported, and free of known vulnerabilities without churn-driven breakage. It sets the cadence for absorbing patch, minor, and major updates, keeps the SBOM and CVE posture fresh, tracks end-of-life (EOL) before it bites, and enforces lockfile and pinning hygiene. This complements dependency-security.skill (which owns SBOM generation and SCA scanning mechanics) by defining the ongoing operational rhythm around it.

Steps

1. Inventory and classify. Enumerate direct and transitive dependencies and classify each by blast radius (runtime-critical, build-only, dev-only) and update risk. Distinguish patch (bug/security, low risk — adopt fast), minor (backward-compatible features, moderate risk — batched), and major (breaking, high risk — planned with migration work).
2. Set the cadence. Define the rhythm per class: patch/security as soon as CI passes; minor on a regular batched window (e.g., weekly/biweekly); major as scheduled, owned migration tasks. State who reviews and merges each class.
3. Refresh the SBOM. Tie SBOM regeneration to the release pipeline so every shipped artifact has a current bill of materials. Diff the SBOM between releases to surface newly introduced or removed components. Defer generation mechanics to dependency-security.skill.
4. Triage CVEs. When an advisory lands, assess: is the vulnerable package actually used, is the vulnerable code path reachable, and what is the severity/exploitability in context. Prioritize remediation (upgrade, patch, or compensating control) by real risk, not raw CVSS alone. Record decisions in the audit trail.
5. Track EOL. Maintain a list of dependencies (and runtimes/base images) approaching end-of-support, with the EOL date and the planned migration target. EOL software stops receiving security fixes — schedule the move before the date, not after.
6. Automate dependency PRs. Configure automated update PRs (grouped by class to reduce noise), with CI gates that must pass before merge. Auto-merge is permissible only for patch/dev updates with green CI and human review reserved for minor/major.
7. Enforce lockfile hygiene. Require committed, deterministic lockfiles; every dependency change updates the lockfile in the same PR. Reject PRs that change manifests without the corresponding lockfile update. Verify resolved versions match the lockfile in CI.
8. Pin the supply chain. Pin dependencies (and CI actions/base images) to exact versions or integrity hashes/digests rather than floating ranges or mutable tags, so builds are reproducible and a hijacked upstream tag cannot silently change resolved code.
9. Assign ownership and write the policy. Name owners for each class and for EOL tracking, then assemble the Output Format below.