skills.rest
jvsandhu
jvsandhuCOMMUNITY
Explore all skills by this author →
GitHub

deps_npm

Manages npm dependencies, package.json configuration, and version control strategies for Node.js projects.

Updated Jan 14, 2026
Search Tags:#ci/cd#npm#dependency management#security audit#node.js#package.json#semver
One-click install
npx skills add https://github.com/jvsandhu/agentic-skills --skill deps-npm-jvsandhu
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: deps_npm
Source: https://github.com/jvsandhu/agentic-skills/tree/main/skills/deps_npm
Command: npx skills add https://github.com/jvsandhu/agentic-skills --skill deps-npm-jvsandhu

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Managing npm dependencies often leads to security vulnerabilities, inconsistent versions across environments, and bloated node_modules folders. This Skill provides a structured workflow for auditing, updating, and locking down JavaScript project dependencies. ## Core Features & Use Cases - package.json Best Practices: Standardized configuration including engines, scripts, and correct separation of dependencies, devDependencies, and peerDependencies. - Version Control Strategy: Clear guidance on semver prefixes (caret, tilde, exact) and enforcing lockfile usage with npm ci. - Three-Phase Workflow: Audit & Analysis (npm audit, license checks), Update Strategy (safe minor/patch updates, depcheck cleanup), and CI/CD Protection (immutable installs, audit gates). - Use Case: Before a release, run the audit phase to fix critical vulnerabilities, remove unused packages with depcheck, and verify the CI pipeline uses npm ci for reproducible builds. ## Quick Start Audit my project's npm dependencies, fix critical vulnerabilities, and verify the lockfile works with a clean npm ci install.

Frequently Asked Questions about deps_npm

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit npm dependencies for security vulnerabilities?▼

Run npm audit to scan your dependency tree for known vulnerabilities and apply fixes for critical issues. In CI pipelines, add npm audit --audit-level=high as a gate so builds fail when high-severity vulnerabilities are present.

What is the difference between npm ci and npm install?▼

npm ci performs an immutable install strictly from package-lock.json, deleting node_modules first, while npm install may update the lockfile. Always use npm ci in CI/CD pipelines to guarantee reproducible builds.

What do caret and tilde mean in package.json versions?▼

Caret (^1.2.3) allows minor and patch updates within the same major version, while tilde (~1.2.3) allows only patch updates. An exact version like 1.2.3 pins the dependency with no automatic updates.

How do I find and remove unused npm packages?▼

Use the depcheck tool to scan your project and identify packages declared in package.json that are never imported. Remove them to reduce install size and shrink the security attack surface.

When should I use dependencies vs devDependencies?▼

dependencies are packages required in production runtime, while devDependencies are only needed for development tasks like testing and linting. peerDependencies declare packages the consuming project must provide itself.

Related Skills

Explore More Software Engineering Skills→
bcwgamesbcwgames

package-management

Install and manage language runtimes, packages, and system dependencies.

Community
Intermediate
timequitytimequity
6

backend-rust

Automate Rust backend hygiene and CI/CD pipelines for Axum APIs.

Official
Advanced
cockroachdbcockroachdb
32.4k

ui-visual-regression

Compare screenshots and network requests between UI branches using roachprod, playwright-cli, and ImageMagick.

Official
Advanced
Montte-erpMontte-erp
6

link-workspace-packages

Link sibling workspace packages and resolve module imports in JavaScript monorepos.

Official
Intermediate