Dependency Management Skill

A Claude Code skill for managing project dependencies — auditing outdated packages, resolving version conflicts, detecting security vulnerabilities, and automating safe upgrade workflows across npm, pip, and other package managers.

When to Use This Skill

Choose this skill when:

• Auditing dependencies for security vulnerabilities or outdated versions
• Resolving conflicting dependency versions or peer dependency issues
• Planning major dependency upgrades (React 18 to 19, Node 18 to 22)
• Reducing bundle size by identifying heavy or redundant packages
• Setting up automated dependency update workflows (Renovate, Dependabot)
• Evaluating whether to add a new dependency vs. building in-house

Consider alternatives when:

• You need to configure a specific build tool (use a Webpack/Vite skill)
• You need runtime dependency injection (use a DI framework skill)
• You need system-level package management (use OS package manager docs)

Quick Start

Copy
# Audit current dependencies
claude "audit my dependencies for security issues and outdated packages"

# Plan a major upgrade
claude "create an upgrade plan for React 18 to React 19"

# Evaluate a new dependency
claude "should I add lodash or use native alternatives?"

Copy
# Common dependency commands
npm audit                    # Security vulnerability scan
npm outdated                 # Show outdated packages
npm ls --all                 # Full dependency tree
npx depcheck                 # Find unused dependencies
npx bundlephobia-cli react   # Check package size

Core Concepts

Dependency Health Assessment

Check	Tool	What It Reveals
Security	npm audit	Known vulnerabilities (CVEs) with severity
Outdated	npm outdated	Packages behind latest version
Unused	depcheck	Dependencies installed but never imported
Size	bundlephobia	Package size impact on bundle
License	license-checker	License compatibility issues
Duplicates	npm ls	Multiple versions of same package

Upgrade Strategy

Copy
# Safe upgrade workflow
# 1. Check what's outdated
npm outdated

# 2. Update patch versions (safe)
npm update

# 3. For major upgrades, check breaking changes first
npm info react changelog

# 4. Upgrade one major dependency at a time
npm install react@19 react-dom@19

# 5. Run tests after each upgrade
npm test

# 6. Lock versions
npm ci  # Verify lock file is consistent

Dependency Evaluation Matrix

Copy
## Should I Add This Dependency?

| Factor | Add It | Build It |
|--------|--------|----------|
| Complexity | Complex algorithm/protocol | Simple utility function |
| Maintenance | Actively maintained, >1000 stars | Abandoned or single maintainer |
| Size | < 50KB gzipped | > 200KB for a small feature |
| Security | Well-audited, no known CVEs | History of vulnerabilities |
| Alternatives | No native equivalent | Built-in API exists |

Configuration

Parameter	Type	Default	Description
package_manager	string	"auto"	Package manager: auto, npm, yarn, pnpm, bun, pip
audit_level	string	"moderate"	Minimum vulnerability severity: low, moderate, high, critical
check_unused	boolean	true	Scan for unused dependencies
check_size	boolean	true	Report bundle size impact
check_licenses	boolean	false	Check license compatibility
auto_fix	boolean	false	Auto-fix compatible vulnerability patches
ignore_dev	boolean	false	Skip devDependencies in audit
max_age_days	number	180	Flag packages not updated in this many days

Best Practices

1. Audit dependencies weekly, not just at release time — vulnerabilities are discovered continuously; set up npm audit in CI so you catch issues before they reach production.

2. Prefer packages with zero dependencies over deep dependency trees — each transitive dependency is a potential vulnerability and maintenance risk; a package with 200 sub-dependencies is riskier than one with zero.

3. Pin exact versions in production applications — use --save-exact or configure .npmrc with save-exact=true; semver ranges introduce non-determinism that can break production builds.

4. Upgrade one major dependency at a time — upgrading multiple major versions simultaneously makes it impossible to identify which upgrade broke what; commit after each successful upgrade.

5. Replace large utility libraries with native alternatives — lodash.get can be replaced with optional chaining, moment with Intl.DateTimeFormat or date-fns; native solutions have zero bundle cost.

Common Issues

Peer dependency conflicts after upgrade — npm 7+ is strict about peer dependencies. Use npm install --legacy-peer-deps as a temporary workaround, but the real fix is upgrading all related packages together (e.g., upgrade React and all React-dependent libraries simultaneously).

npm audit reports vulnerabilities in dev dependencies — Dev-only vulnerabilities don't affect production users. Use npm audit --omit=dev to focus on production risks, and accept dev dependency advisories as lower priority.

Lock file conflicts in team environments — Multiple developers running npm install with different npm versions creates merge conflicts in package-lock.json. Standardize npm versions across the team using .nvmrc and engines in package.json.