Agent Skills
› cosmicstack-labs/mercury-agent-skills
› dependency-management
dependency-management
GitHub提供依赖管理最佳实践，涵盖版本锁定策略、漏洞扫描工具与流程、Monorepo模式及升级工作流，旨在规模化安全地管理项目依赖。
Trigger Scenarios
需要制定或优化依赖版本策略
执行依赖漏洞扫描与安全审计
处理Monorepo依赖冲突与去重
规划依赖升级与发布流程
Install
npx skills add cosmicstack-labs/mercury-agent-skills --skill dependency-management -g -y
SKILL.md
Frontmatter
{
"name": "dependency-management",
"metadata": {
"tags": [
"dependencies",
"package-management",
"security",
"monorepo",
"upgrades"
],
"author": "cosmicstack-labs",
"version": "1.0.0",
"category": "development"
},
"description": "Version pinning, vulnerability scanning, monorepo patterns, and upgrade workflows"
}
Dependency Management
Safely manage project dependencies at scale.
Version Strategy
Pinning Approaches
| Strategy | Format | Risk | Best For |
|---|---|---|---|
| Exact | 1.2.3 |
Low | Docker, CI, production |
| Caret | ^1.2.3 |
Medium | Libraries, apps with good tests |
| Tilde | ~1.2.3 |
Low-Medium | Conservative updates |
| Range | >=1.2.3 <2.0.0 |
High | Rare, legacy |
| Floating | * |
Very High | Never in production |
Rule: Pin exact versions for production, caret for libraries.
Vulnerability Scanning
Tools
- npm audit /
yarn audit— quick JS check - Dependabot — GitHub-native, auto PRs
- Snyk — deeper scanning, prioritization
- Trivy — container scanning
- OWASP Dependency-Check — Java/.NET
Workflow
- Scan on every PR (fail on critical/high)
- Weekly full scan of all repos
- Patch critical (<7 days), high (<30 days)
- Track CVEs by severity in dashboard
- SBOM generation per release
Monorepo Patterns
- Use workspaces (npm/yarn/pnpm workspaces)
- Shared dependency versions (single source of truth)
- Independent vs locked version strategy
- Deduplicate (npx dedupe after major changes)
- Audit tree to find conflicting transitive deps
Upgrade Workflow
- Check changelog for breaking changes
- Run tests (you have tests, right?)
- Upgrade one major version at a time
- Run full test suite + build
- Deploy to staging, verify
- Monitor for regressions (logs, metrics, errors)
Version History
- 38e2523 Current 2026-07-05 19:38
