Dependency Management — Production Patterns

Modern Best Practices (January 2026): Lockfile-first workflows, automated security scanning (Dependabot, Snyk, Socket.dev), semantic versioning, minimal dependencies principle, monorepo workspaces (pnpm, Nx, Turborepo), supply chain security (SBOM, AI BOM, Sigstore), reproducible builds, and AI-generated code validation.

When to Use This Skill

The agent should invoke this skill when a user requests:

• Adding new dependencies to a project
• Updating existing dependencies safely
• Resolving dependency conflicts or version mismatches
• Auditing dependencies for security vulnerabilities
• Understanding lockfile management and reproducible builds
• Setting up monorepo workspaces (pnpm, npm, yarn)
• Managing transitive dependencies and overrides
• Choosing between similar packages (bundle size, maintenance, security)
• Dependency version constraints and semantic versioning