Dependency Management

Dependency Management

Safely manage project dependencies at scale.

Version Strategy

Pinning Approaches

| Strategy | Format | Risk | Best For |

|----------|--------|------|----------|

| Exact | 1.2.3 | Low | Docker, CI, production |

| Caret | ^1.2.3 | Medium | Libraries, apps with good tests |

| Tilde | ~1.2.3 | Low-Medium | Conservative updates |

| Range | >=1.2.3 <2.0.0 | High | Rare, legacy |

| Floating | * | Very High | Never in production |

Rule: Pin exact versions for production, caret for libraries.

Vulnerability Scanning

Tools

• npm audit / yarn audit — quick JS check
• Dependabot — GitHub-native, auto PRs
• Snyk — deeper scanning, prioritization
• Trivy — container scanning
• OWASP Dependency-Check — Java/.NET

Workflow

• Scan on every PR (fail on critical/high)
• Weekly full scan of all repos
• Patch critical (<7 days), high (<30 days)
• Track CVEs by severity in dashboard
• SBOM generation per release

Monorepo Patterns

• Use workspaces (npm/yarn/pnpm workspaces)
• Shared dependency versions (single source of truth)
• Independent vs locked version strategy
• Deduplicate (npx dedupe after major changes)
• Audit tree to find conflicting transitive deps

Upgrade Workflow

• Check changelog for breaking changes
• Run tests (you have tests, right?)
• Upgrade one major version at a time
• Run full test suite + build
• Deploy to staging, verify
• Monitor for regressions (logs, metrics, errors)