dependency-management
About
This Claude Skill enforces fixed version dependency installation across all package managers to ensure reproducible builds, supply chain security, and stability. It provides guidance for installing packages, updating dependencies, and working with configuration files like package.json and requirements.txt. Use it when reviewing dependency configurations or configuring CI/CD pipelines to maintain consistent dependency management practices.
Documentation
Dependency Management
Basic Principles
Always Use Exact Versions
- Use exact versions only:
package@1.2.3 - Forbid:
^1.2.3,~1.2.3,latest,*, version ranges - Exception: Library peerDependencies only
Lock Files Are Mandatory
- Always commit to version control
- Forbid manual editing
- CI/CD must use frozen/locked mode
Security Audit First
- Check vulnerabilities before installation
- Automate regular audits
Installation Commands
# Node.js
npm install --save-exact package@1.2.3
pnpm add --save-exact package@1.2.3
yarn add --exact package@1.2.3
# Python
pip install package==1.2.3
poetry add package@1.2.3
# Go
go get package@v1.2.3
# Rust
cargo add package@=1.2.3
# PHP
composer require vendor/package:1.2.3
# Ruby (Gemfile)
gem 'package', '1.2.3'
# Java/Kotlin
implementation("group:artifact:1.2.3") # Gradle
<version>1.2.3</version> # Maven
# .NET
dotnet add package PackageName --version 1.2.3
CI/CD Commands
npm ci # npm
pnpm install --frozen-lockfile # pnpm
yarn install --frozen-lockfile # yarn
poetry install --no-update # poetry
go mod verify # go
cargo build --locked # rust
composer install --no-update # php
bundle install --frozen # ruby
dotnet restore --locked-mode # .NET
Common Mistakes
| ❌ Wrong | ✅ Correct |
|---|---|
npm install (CI) | npm ci |
package@latest | package@1.2.3 |
package@^1.2.3 | package@1.2.3 |
| Lock file in .gitignore | Commit lock file |
| Manual lock file editing | Regenerate via package manager |
Quick Install
/plugin add https://github.com/KubrickCode/ai-config-toolkit/tree/main/dependency-managementCopy and paste this command in Claude Code to install this skill
GitHub 仓库
Related Skills
sglang
MetaSGLang is a high-performance LLM serving framework that specializes in fast, structured generation for JSON, regex, and agentic workflows using its RadixAttention prefix caching. It delivers significantly faster inference, especially for tasks with repeated prefixes, making it ideal for complex, structured outputs and multi-turn conversations. Choose SGLang over alternatives like vLLM when you need constrained decoding or are building applications with extensive prefix sharing.
llamaguard
OtherLlamaGuard is Meta's 7-8B parameter model for moderating LLM inputs and outputs across six safety categories like violence and hate speech. It offers 94-95% accuracy and can be deployed using vLLM, Hugging Face, or Amazon SageMaker. Use this skill to easily integrate content filtering and safety guardrails into your AI applications.
evaluating-llms-harness
TestingThis Claude Skill runs the lm-evaluation-harness to benchmark LLMs across 60+ standardized academic tasks like MMLU and GSM8K. It's designed for developers to compare model quality, track training progress, or report academic results. The tool supports various backends including HuggingFace and vLLM models.
langchain
MetaLangChain is a framework for building LLM applications using agents, chains, and RAG pipelines. It supports multiple LLM providers, offers 500+ integrations, and includes features like tool calling and memory management. Use it for rapid prototyping and deploying production systems like chatbots, autonomous agents, and question-answering services.