Dependency Management

Overview

Every dependency is a commitment -- to its maintenance, security surface, and upgrade path. Add deliberately, update strategically, audit regularly.

Core principle: Every dependency decision should be justified. Don't add what you can write. Don't ignore what you can update. Don't skip what you can audit.

When to Use

• Adding a new package or library to a project
• Security audit warnings (npm audit, pip-audit, cargo audit, etc.)
• Batch dependency update time
• Major version upgrade decisions
• Choosing between alternative libraries
• Lockfile merge conflicts
• Questioning if a package is still maintained