dependency-manager

Dependency Manager

When to use this skill

• Updating outdated dependencies
• Fixing security vulnerability alerts (Dependabot, npm audit)
• Resolving dependency conflicts or version mismatches
• Adding new packages (choosing the right ones)
• Cleaning up unused dependencies
• Migrating between package managers

Step 1: Assess current state

Node.js / npm / yarn

# Check for outdated packages
npm outdated
yarn outdated

# Security audit
npm audit
yarn audit

# List installed packages
npm ls --depth=0
npm ls <package-name>  # Check specific package tree

# Find unused dependencies
npx depcheck

Python / pip

# Check outdated
pip list --outdated

# Security audit
pip-audit
safety check

# Show dependency tree
pipdeptree

Step 2: Update strategy

Semantic versioning guide

MAJOR.MINOR.PATCH
^2.1.0  → allows 2.x.x (minor + patch updates)
~2.1.0  → allows 2.1.x (patch updates only)
2.1.0   → exact version (no updates)

Safe update order

1. Patch updates first — bug fixes, lowest risk:

   npm update  # Updates within semver range
   

2. Minor updates — new features, backward compatible:

   npx npm-check-updates --target minor -u
   npm install
   npm test
   

3. Major updates — one at a time, may have breaking changes:

   npm install <package>@latest
   # Read CHANGELOG/migration guide
   # Run tests
   # Fix breaking changes
   # Commit
   

Step 3: Handle vulnerabilities

# View audit details
npm audit

# Auto-fix where possible
npm audit fix

# Force fix (may include breaking changes — review carefully)
npm audit fix --force

# If a vulnerability is in a transitive dependency:
# 1. Check if parent package has a newer version
npm ls <vulnerable-package>
# 2. Override the transitive version
# In package.json:

{
  "overrides": {
    "vulnerable-package": "^2.0.1"
  }
}

Step 4: Resolve conflicts

Peer dependency conflicts

# See the conflict
npm install --dry-run

# Option 1: Use --legacy-peer-deps (temporary)
npm install --legacy-peer-deps

# Option 2: Fix by aligning versions
# Read both packages' peerDependencies and find compatible range