dependency-management
Manage third-party libraries, runtimes, and SaaS dependencies. Use this skill when setting an update cadence, responding to security advisories, dealing with deprecated dependencies, evaluating new dependencies, auditing what's installed, or unblocking a dependency upgrade. Triggers on dependency, package update, security patch, lockfile, deprecated, breaking change, supply chain, dependency audit, npm audit, dependabot, renovate. Also triggers when a build breaks after an update or when an advisory is published for a used package.
Profile →npx skills add rampstackco/claude-skills --skill dependency-management --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# Dependency Management Decide what to depend on, keep dependencies current, respond to advisories, and reduce supply chain risk. Stack-agnostic principles; specifics vary by package manager. --- ## When to use - Setting up dependency hygiene for a new or existing project - Responding to a security advisory - Major version upgrade of a key dependency - Adding a new dependency (evaluation, decision) - Removing a dependency (cleanup) - Audit of what's installed and what's actually used - Setting an update cadence and policy - Diagnosing a broken build after an update ## When NOT to use - General code review (use `code-review-web`) - Vulnerability scanning of infrastructure (use `security-baseline`) - Pinning vendor or service contracts (use `vendor-evaluation`) - Performance impact of dependencies (use `performance-optimization`) --- ## Required inputs - Package manager and lockfile in use (npm, yarn, pnpm, pip, gem, composer, etc.) - Current dependency list (production and dev) - Current advisories (run audit; check service like Snyk, Dependabot) - Update history (when were major dependencies last updated) - Risk profile (production criticality, change tolerance) --- ## The framewor
- When to use
- When NOT to use
- Required inputs
- The framework: 4 categories of dependency
- Category 1: Critical runtime
- Category 2: Supporting runtime
- Category 3: Dev/build
- Category 4: Optional/dev-only-personal
- The framework: 5 risk dimensions
- Dimension 1: Maintenance health
- Dimension 2: Surface area
- Dimension 3: Replaceability
- Dimension 4: Trust
- Dimension 5: Cost
npm/yarn/pnpm npm ls --all --json pip pip list gem bundle list npm audit yarn audit pip-audit bundle audit
What does the dependency-management skill do?
Manage third-party libraries, runtimes, and SaaS dependencies. Use this skill when setting an update cadence, responding to security advisories, dealing with deprecated dependencies, evaluating new dependencies, auditing what's installed, or unblocking a dependency upgrade. Triggers on dependency, package update, security patch, lockfile, deprecated, breaking change, supply chain, dependency audit, npm audit, dependabot, renovate. Also triggers when a build breaks after an update or when an advisory is published for a used package.
How do I install it?
Run `npx skills add rampstackco/claude-skills --skill dependency-management --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From rampstackco/claude-skills, a repository with 515 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.