Dependency Health

Systematic dependency management: security-first, batch remediation, policy-driven.

Dependencies are attack surface. Manage them systematically, not reactively.

When to Use This Skill

Use this skill when:

• 🔒 Security vulnerabilities: Known CVEs in dependencies
• 📅 Outdated dependencies: Packages months/years behind
• ⚖️ License compliance: Need to verify license compatibility
• 🎯 Systematic management: Ad-hoc updates causing issues
• 🔄 Frequent breakage: Dependency updates break builds
• 📊 No visibility: Don't know dependency health status

Don't use when:

• ❌ Zero dependencies (static binary, no external deps)
• ❌ Dependencies already managed systematically
• ❌ Short-lived projects (throwaway tools, prototypes)
• ❌ Frozen dependencies (legacy systems, no updates allowed)

Quick Start (30 minutes)

Step 1: Audit Current State (10 min)

# Go projects
go list -m -u all | grep '\['

# Node.js
npm audit

# Python
pip list --outdated

# Identify:
# - Security vulnerabilities
# - Outdated packages (>6 months old)
# - License issues

Step 2: Prioritize by Security (10 min)

Severity levels:

• Critical: Actively exploited, RCE, data breach
• High: Authentication bypass, privilege escalation
• Medium: DoS, information disclosure
• Low: Minor issues, limited impact

Action timeline:

• Critical: Immediate (same day)
• High: Within 1 week
• Medium: Within 1 month
• Low: Next quarterly update

Step 3: Batch Remediation (10 min)

# Group compatible updates
# Test together
# Create single PR with all updates

# Example: Update all patch versions
go get -u=patch ./...
go test ./...
git commit -m "chore(deps): update dependencies (security + freshness)"

Security-First Prioritization

Vulnerability Assessment

Critical vulnerabilities (immediate action):

• RCE (Remote Code Execution)
• SQL Injection
• Authentication bypass
• Data breach potential

High vulnerabilities (1 week):

• Privilege escalation
• XSS (Cross-Site Scripting)
• CSRF (Cross-Site Request Forgery)
• Sensitive data exposure

Medium vulnerabilities (1 month):

• DoS (Denial of Service)
• Information disclosure
• Insecure defaults
• Weak cryptography

Low vulnerabilities (quarterly):

• Minor issues
• Informational
• False positives

Remediation Strategy

Priority queue:
1. Critical vulnerabilities (immediate)
2. High vulnerabilities (week)
3. Dependency freshness (monthly)
4. License compliance (quarterly)
5. Medium/low vulnerabilities (quarterly)

Batch Remediation Strategy

Why Batch Updates?

Problems with one-at-a-time:

• Update fatigue (100+ dependencies)
• Test overhead (N tests for N updates)
• PR overhead (N reviews)
• Potential conflicts (update A breaks with update B)

Benefits of batching:

• Single test run for all updates
• Single PR review
• Detect incompatibilities early
• 6x faster (validated in meta-cc)

Batching Strategies

Strategy 1: By Severity

# Batch 1: All security patches
# Batch 2: All minor/patch updates
# Batch 3: All major updates (breaking changes)

Strategy 2: By Compatibility

# Batch 1: Compatible updates (no breaking changes)
# Batch 2: Breaking changes (one at a time)

Strategy 3: By Timeline

# Batch 1: Immediate (critical vulnerabilities)
# Batch 2: Weekly (high vulnerabilities + freshness)
# Batch 3: Monthly (medium vulnerabilities)
# Batch 4: Quarterly (low vulnerabilities + license)

Policy-Driven Compliance

Security Policies

# .dependency-policy.yml
security:
  critical_vulnerabilities:
    action: block_merge
    max_age: 0 days
  high_vulnerabilities:
    action: block_merge
    max_age: 7 days
  medium_vulnerabilities:
    action: warn
    max_age: 30 days

Freshness Policies

freshness:
  max_age:
    major: 12 months
    minor: 6 months
    patch: 3 months
  exceptions:
    - package: legacy-lib
      reason: "No maintained alternative"

License Policies

licenses:
  allowed:
    - MIT
    - Apache-2.0
    - BSD-3-Clause
  denied:
    - GPL-3.0  # Copyleft issues
    - AGPL-3.0
  review_required:
    - Custom
    - Proprietary

Automation Tools

Vulnerability Scanning

# Go: govulncheck
go install golang.org/x/vuln/cmd/govulncheck@latest
govulncheck ./...

# Node.js: npm audit
npm audit --audit-level=moderate

# Python: safety
pip install safety
safety check

# Rust: cargo-audit
cargo install cargo-audit
cargo audit

Automated Updates

# Dependabot (GitHub)
# .github/dependabot.yml
version: 2
updates:
  - package-ecosystem: "gomod"
    directory: "/"
    schedule:
      interval: "weekly"
    open-pull-requests-limit: 5
    groups:
      security:
        patterns:
          - "*"
        update-types:
          - "patch"
          - "minor"

License Checking

# Go: go-licenses
go install github.com/google/go-licenses@latest
go-licenses check ./...

# Node.js: license-checker
npx license-checker --summary

# Python: pip-licenses
pip install pip-licenses
pip-licenses

Proven Results

Validated in bootstrap-010 (meta-cc project):

• ✅ Security-first prioritization implemented
• ✅ Batch remediation (5 dependencies updated together)
• ✅ 6x speedup: 9 hours manual → 1.5 hours systematic
• ✅ 3 iterations (rapid convergence)
• ✅ V_instance: 0.92 (highest among experiments)
• ✅ V_meta: 0.85

Metrics:

• Vulnerabilities: 2 critical → 0 (resolved immediately)
• Freshness: 45% outdated → 15% outdated
• License compliance: 100% (all MIT/Apache-2.0/BSD)

Transferability:

• Go (gomod): 100% (native)
• Node.js (npm): 90% (npm audit similar)
• Python (pip): 85% (safety similar)
• Rust (cargo): 90% (cargo audit similar)
• Java (Maven): 85% (OWASP dependency-check)
• Overall: 88% transferable

Common Patterns

Pattern 1: Security Update Workflow

# 1. Scan for vulnerabilities
govulncheck ./...

# 2. Review severity
# Critical/High → immediate
# Medium/Low → batch

# 3. Update dependencies
go get -u github.com/vulnerable/package@latest

# 4. Test
go test ./...

# 5. Commit
git commit -m "fix(deps): resolve CVE-XXXX-XXXXX in package X"

Pattern 2: Monthly Freshness Update

# 1. Check for updates
go list -m -u all

# 2. Batch updates (patch/minor)
go get -u=patch ./...

# 3. Test
go test ./...

# 4. Commit
git commit -m "chore(deps): monthly dependency freshness update"

Pattern 3: Major Version Upgrade

# One at a time (breaking changes)
# 1. Update single package
go get package@v2

# 2. Fix breaking changes
# ... code modifications ...

# 3. Test extensively
go test ./...

# 4. Commit
git commit -m "feat(deps): upgrade package to v2"

Anti-Patterns

❌ Ignoring security advisories: "We'll update later" ❌ One-at-a-time updates: 100 separate PRs for 100 dependencies ❌ Automatic merging: Dependabot auto-merge without testing ❌ Dependency pinning forever: Never updating to avoid breakage ❌ License ignorance: Not checking license compatibility ❌ No testing after updates: Assuming updates won't break anything

Related Skills

Parent framework:

• methodology-bootstrapping - Core OCA cycle

Complementary:

• ci-cd-optimization - Automated dependency checks in CI
• error-recovery - Dependency failure handling

Acceleration:

• rapid-convergence - 3 iterations achieved

References

Core guides:

• Reference materials in experiments/bootstrap-010-dependency-health/
• Security-first prioritization framework
• Batch remediation strategies
• Policy-driven compliance

Tools:

• govulncheck (Go)
• npm audit (Node.js)
• safety (Python)
• cargo-audit (Rust)
• go-licenses (license checking)

Status: ✅ Production-ready | 6x speedup | 88% transferable | V_instance 0.92 (highest)