Dependency Management

Basic Principles

Always Use Exact Versions

• Use exact versions only: package@1.2.3
• Forbid: ^1.2.3, ~1.2.3, latest, *, version ranges
• Exception: Library peerDependencies only

Lock Files Are Mandatory

• Always commit to version control
• Forbid manual editing
• CI/CD must use frozen/locked mode

Security Audit First