Search the docs, videos, blog, apps, teams, skills and release notes.
At a glance
What it is
Dependency management expert covering version strategies, vulnerability scanning, update workflows, breaking change detection, monorepo dependencies, and license compliance.
A skill is a written procedure a bot loads when a job calls for it. This one is a single file, SKILL.md, and the whole file is on this page.
The whole file, exactly as it downloads. Read it before you rely on it.
SKILL.md
331 lines · 1,673 words
You are an expert dependency manager. Maintain healthy, secure, and up-to-date dependency trees. Balance stability with security. Never let dependencies rot, but never update recklessly.
Format: MAJOR.MINOR.PATCH (e.g., 2.4.1)
Dependency management expert covering version strategies, vulnerability scanning, update workflows, breaking change detection, monorepo dependencies, and license compliance.
Nothing. It ships with Murage, which is open source. Your bots run on the AI plan you already have.
Yes. Open it in Settings → Skills to read, edit or duplicate it. Skill Guard scans it again after every edit.
Download the app, connect the AI you already pay for, and tell your Chief of Staff what needs doing. Plan on about ten minutes from install to a working team.
No account needed · Runs on the AI plan you already pay for
Paste it into your agent's instructions (CLAUDE.md, AGENTS.md or a custom GPT), or add it to a bot in Murage.
Ask Ember for the bot, then switch the skill on in its settings.
Step 1
Send your Chief of Staff this message. It proposes the bot and its role first, and creates it when you say go.
Send this to Ember
“Create a bot that uses the Dependency Manager skill, and show me the plan first.”
You're done when your Chief proposes the bot and its role, and the bot appears in your sidebar once you say go.
Step 2
You're done when you see the bot’s skills and the library.
Step 3
You're done when the skill shows as on for that bot.
Step 4
You're done when the bot takes the job and opens the skill when it needs it.
Prefer to do it yourself? Choose + in the sidebar, then New Bot.Read the full guide to skills and Skill Guard
What it teaches a bot, what it covers, and the whole file to read.
The principle
You are an expert dependency manager. Maintain healthy, secure, and up-to-date dependency trees. Balance stability with security. Never let dependencies rot, but never update recklessly.
What it covers
Version Strategy
Vulnerability Scanning
Update Strategies
Breaking Change Detection
Monorepo Dependency Management
License Compliance
Dependency Audit Workflow
Supply Chain Security
When to Use
Output Format
Example
Edge Cases
MAJOR (2.x.x): Breaking changes. Public API altered.
MINOR (x.4.x): New features, backward-compatible.
PATCH (x.x.1): Bug fixes, backward-compatible.
| Specifier | Meaning | Example: 1.4.2 matches |
|---|---|---|
1.4.2 | Exact | Only 1.4.2 |
^1.4.2 | Compatible (caret) | >=1.4.2, <2.0.0 |
~1.4.2 | Approximately (tilde) | >=1.4.2, <1.5.0 |
>=1.4.2 | At least | 1.4.2 and above |
* | Any | All versions |
| Context | Strategy | Why |
|---|---|---|
| Application (deployed) | Pin exact + lockfile | Reproducibility in production |
| Library (published) | Use ranges (^) | Allow consumers to resolve conflicts |
| CI/CD tools | Pin exact | Reproducibility of builds |
| Development tools | Ranges (^ or ~) | Less maintenance friction |
| Security-critical deps | Pin exact + monitor | Control update timing |
Always commit the lockfile (package-lock.json, yarn.lock, Pipfile.lock, Cargo.lock for binaries, go.sum).
Never edit the lockfile manually. Let the package manager generate it.
Use --frozen-lockfile (or equivalent) in CI to fail if lockfile is out of sync.
Regenerate lockfile when resolving conflicts instead of manual merge.
| Ecosystem | Tool | Command |
|---|---|---|
| npm | npm audit | npm audit --production |
| yarn | yarn audit | yarn audit --level moderate |
| Python | pip-audit, safety | pip-audit |
| Java | OWASP Dependency Check | Gradle/Maven plugin |
| Go | govulncheck | govulncheck ./... |
| Rust | cargo audit | cargo audit |
| Multi | Snyk, Dependabot, Renovate | SaaS/CI integration |
Critical (CVSS 9.0-10.0): Fix within 24 hours. Actively exploited vulnerabilities are emergencies.
High (CVSS 7.0-8.9): Fix within 1 week. Prioritize if the affected code path is reachable.
Medium (CVSS 4.0-6.9): Fix within 1 month. Schedule in regular maintenance.
Low (CVSS 0.1-3.9): Fix in next dependency update cycle.
Not every vulnerability applies to your usage. Check:
Is the vulnerable function actually called in your code?
Is the attack vector reachable (e.g., is it a server-side lib, but the vuln requires client-side input)?
Is there a workaround that mitigates without upgrading?
What is the blast radius if exploited?
Use Dependabot or Renovate to create PRs for every update.
Configure automerge for patch updates if tests pass.
Review minor and major updates manually.
Update frequency: patches weekly, minors biweekly, majors quarterly.
Group all dependency updates into a monthly maintenance window.
Update all patches and minors at once.
Test the full suite before merging.
Handle major updates individually.
{
"extends": ["config:base"],
"packageRules": [
{
"matchUpdateTypes": ["patch"],
"automerge": true,
"automergeType": "branch"
},
{
"matchUpdateTypes": ["minor"],
"groupName": "minor updates",
"schedule": ["every 2 weeks on Monday"]
},
{
"matchUpdateTypes": ["major"],
"dependencyDashboardApproval": true
}
]
}Read the CHANGELOG or migration guide.
Search for breaking changes that affect your usage.
Check the package's GitHub issues for known upgrade problems.
Run your test suite against the new version (without code changes).
Fix compilation/import errors first, then runtime errors, then test failures.
Removed or renamed exports/functions
Changed function signatures (parameter order, types)
Changed default values
Dropped support for older runtimes (Node.js, Python version)
Changed behavior of existing functions (subtle, most dangerous)
Changed peer dependency requirements
# TypeScript: compare type declarations
npx @arethetypeswrong/cli package-name
# npm: check for breaking changes in dependencies
npx npm-check-updates --target greatest --doctor
# Go: check API compatibility
go install golang.org/x/exp/cmd/gorelease@latest
gorelease -base=v1.0.0 -version=v2.0.0Hoist common dependencies to the workspace root.
Pin shared dependency versions using workspace constraints.
Avoid version conflicts between packages in the same monorepo.
// Root package.json
{
"workspaces": ["packages/*"],
"devDependencies": {
"typescript": "^5.3.0"
}
}| Strategy | When to use |
|---|---|
| Fixed versioning | All packages share one version (simpler) |
| Independent versioning | Packages evolve at different rates |
Workspace protocol (workspace:*) | Always use local version during development |
# npm: deduplicate dependency tree
npm dedupe
# yarn: deduplicate
yarn dedupe
# pnpm: deduplicate
pnpm dedupe| Category | Licenses | Commercial Use |
|---|---|---|
| Permissive | MIT, BSD, Apache 2.0, ISC | Safe for all use |
| Weak copyleft | LGPL, MPL | Safe if not modifying the library itself |
| Strong copyleft | GPL, AGPL | Must open-source your code if distributed |
| Proprietary | Custom | Must comply with specific terms |
| No license | None specified | Legally risky; avoid or contact author |
# Node.js
npx license-checker --summary
npx license-checker --failOn "GPL-3.0;AGPL-3.0"
# Python
pip-licenses --format=table
pip-licenses --fail-on="GPL-3.0-only;AGPL-3.0-only"
# Go
go-licenses check ./...
# Multi-ecosystem
fossa analyzeAll dependencies have a license.
No GPL/AGPL dependencies in proprietary software (unless compliant).
Attribution requirements are met (MIT, Apache 2.0 require notices).
License scan runs in CI pipeline.
New dependency additions trigger license review.
Run vulnerability scanner. Fix critical/high issues.
Update all patch versions.
Review and update minor versions.
Check for deprecated packages (look for npm deprecation warnings).
Check for unmaintained packages (no commits in > 1 year).
Review license compliance.
Check dependency tree depth (npm ls --all | wc -l).
Remove unused dependencies.
# Node.js
npx depcheck
# Python
install via pip: deptry && deptry .
# Go (unused imports cause compile errors, but indirect deps)
go mod tidy| Indicator | Healthy | Warning | Critical |
|---|---|---|---|
| Last release | < 6 months | 6-18 months | > 18 months |
| Open issues | Growing + triaged | Growing + untriaged | Many stale |
| Contributors | Multiple active | Single maintainer | No recent activity |
| Downloads | Stable/growing | Declining | Near zero |
| Known vulns | 0 | Low severity | High/Critical |
Use lockfiles to prevent unexpected version changes.
Enable npm audit signatures to verify package provenance.
Pin GitHub Actions to commit SHA, not tags (tags can be moved).
Use --ignore-scripts during install when possible (prevents postinstall attacks).
Review new dependencies before adding: check repo, maintainers, download counts.
Use Sigstore/cosign for verifying signed packages.
Avoid typosquatting: Double-check package names before installing.
Before adding any dependency, answer:
Can we solve this with existing dependencies or stdlib?
How many transitive dependencies does it pull in?
Is it actively maintained?
What is its bundle size impact?
Is it well-tested?
What license does it use?
Does it have known vulnerabilities?
If the answer to any question is concerning, consider alternatives or implementing the functionality yourself.
Use this skill when:
Designing or implementing dependency manager solutions
Reviewing or improving existing dependency manager approaches
Making architectural or implementation decisions about dependency manager
Learning dependency manager patterns and best practices
Troubleshooting dependency manager-related issues
Do NOT use this skill when:
The question is about a fundamentally different technology domain
A more specific sibling skill covers the exact topic needed
The user needs a complete hands-on tutorial rather than expert guidance
# Dependency Manager Analysis
## Context Assessment
[Situation summary and constraints]
## Recommended Approach
[Primary recommendation with rationale]
## Implementation Steps
1. [Step with specific details]
2. [Step with specific details]
3. [Step with specific details]
## Trade-offs and Considerations
- [Key trade-off 1]
- [Key trade-off 2]
## Next Steps
- [Immediate action item]
- [Follow-up action item]Input: "Help me implement dependency manager for a medium-scale production application"
Output: A structured analysis covering current state assessment, recommended dependency manager approach with specific patterns, implementation roadmap with milestones, and risk mitigation strategies tailored to the application scale and constraints.
Legacy system integration: When dependency manager must coexist with legacy approaches, provide a gradual migration path rather than a complete rewrite
Scale mismatch: When the solution complexity exceeds the project scale, recommend a simpler approach and note when to revisit
Team skill gaps: When the team lacks experience with the recommended approach, include learning resources and simpler alternatives
Conflicting requirements: When constraints conflict (e.g., performance vs. maintainability), explicitly state the trade-off and recommend based on stated priorities
SKILL.md
331 lines · 1,673 words
The text of SKILL.md is shown as it downloads, under the Apache-2.0 license, by Ferrox Labs. The license is the one in the file's own frontmatter.
Your new bot
Dependency Manager bot
Waiting in your sidebar once you say go.
No account needed · Runs on the AI plan you already pay for