Dependency Management

Principles

• Every dependency you add is code you didn’t write but are responsible for running. Fewer, well-maintained dependencies beat many small, unmaintained ones.
• Automate vulnerability detection — don’t rely on someone remembering to check.

Adding a new dependency

Before adding a new dependency, briefly consider:

• Is it actively maintained (recent commits/releases, responsive to issues)?
• Does it have a reasonable number of users/downloads relative to its age?
• Does it have known unresolved vulnerabilities?
• Could the functionality reasonably be written in a few lines instead?

Keeping dependencies current

• Enable automated dependency update tooling (e.g. Dependabot, Renovate) on every repository.
• Enable vulnerability/supply-chain scanning in CI (e.g. npm audit, pip-audit, GitHub’s Dependabot alerts, or an SCA tool) and fail the build on new high/critical findings.
• Review and merge dependency update PRs regularly rather than letting them pile up — the longer an update is deferred, the riskier and larger the eventual jump.

Lockfiles

• Commit lockfiles (package-lock.json, poetry.lock, go.sum, etc.) so builds are reproducible and you can review exactly what changed in an update.
• Use npm ci (or the equivalent) in CI/CD rather than npm install, so builds fail loudly instead of silently drifting from the lockfile.

Supply chain hygiene

• Pin GitHub Actions to a full commit SHA (or at least a version tag) rather than a floating branch.
• Be cautious with post-install scripts from dependencies; consider disabling them by default where your package manager supports it.