package-dependency-management

What problem does it solve?

This Skill prevents risky dependency changes by enforcing lockfile discipline, transitive risk review, license compatibility checks, and supply-chain security guardrails across ecosystems.

Core Features & Use Cases

• Dependency governance: Choose and change package-manager behavior, lockfiles, workspaces, and resolution rules with explicit justification.
• Reproducible installs: Require deterministic CI installs (e.g., npm ci, frozen installs, locked builds) to avoid “works on my machine” drift.
• Supply-chain + compliance checks: Review transitive graphs, install-script risk, SBOM generation, vulnerability scanning, and license compatibility before merge.
• Runtime compatibility control: Detect when a dependency change implies runtime shifts and escalate accordingly.

Quick Start

Use the package-dependency-management skill to vet a proposed dependency upgrade by checking lockfile reproducibility, transitive impact, license compatibility, SBOM requirements, and vulnerability posture before approving the change.