---

name: dependency-management description: > Use this skill when the user says 'Dependabot', 'Renovate', 'dependencies', 'lock file', 'vulnerability scanning', 'update strategy', 'Renovate config', 'dependabot.yml', 'dependency bump', 'automated updates', 'version pinning', 'patch management', 'supply chain security', 'npm audit', 'SBOM'. Covers: Dependabot configuration, Renovate configuration, lock file management, vulnerability scanning, update strategy, dependency policy. Do NOT use this for: monorepo workspace configuration, package.json structure, or dependency graph visualization (use monorepo skill). version: "1.0.0" author: "j4flmao" license: "MIT" compatibility: claude-code: true cursor: true codex: true windsurf: true tags: [devops, dependencies, dependabot, renovate, security, phase-5]

Dependency Management

Purpose

Automate dependency updates, vulnerability scanning, and policy enforcement with Dependabot and Renovate.

Agent Protocol

Trigger

Exact user phrases: "Dependabot", "Renovate", "dependencies", "lock file", "vulnerability scanning", "update strategy", "dependabot.yml", "dependency bump", "automated updates", "version pinning", "patch management", "supply chain security", "SBOM", "npm audit".

Input Context

• Package ecosystem (npm, pip, maven, go, cargo, nuget, docker, terraform).
• Package manager (npm, yarn, pnpm, pip, poetry, maven, gradle, go, cargo).
• Automation tool (Dependabot, Renovate, or both).
• Update cadence (daily, weekly, monthly).
• Vulnerability severity threshold (critical only, high+, all).

Output Artifact

Writes to .github/dependabot.yml, renovate.json, or .github/renovate.json.

Response Format

dependabot.yml or renovate.json with no extraneous explanation.

No preamble. No postamble. No explanations. No filler/hedging/transitions.

Completion Criteria

• Dependabot or Renovate configured for the project's ecosystems.
• Update schedule and strategy defined.
• Auto-merge rules configured for safe updates.
• Vulnerability scanning enabled with alerting.
• Lock file committed and kept up-to-date.

Architecture / Decision Trees

Tool Selection: Dependabot vs Renovate

Feature	Dependabot	Renovate
Configuration	YAML (dependabot.yml)	JSON (renovate.json)
Auto-merge	Via GitHub Actions	Built-in (platformAutomerge)
Grouped updates	Manual allow lists	Automatic grouping rules
Custom registries	Limited	Extensive (any host)
Onboarding PR	No	Yes (configurable)
Regex manager	No	Yes (Docker, custom)
Presets/shared config	No (org-level only)	Presets, extends, shareable
Lock file maintenance	Manual	Built-in schedule
Dashboard	Dependencies tab only	Dependency Dashboard PR
Rate limiting	GitHub API limits	Configurable concurrency
Monorepo support	Per-directory config	Automatic workspace detection
Self-hosted	Via GitHub	Via Renovate self-hosted

Update Strategy Decision Tree

• Major version updates: manual review with quarterly batch.
• Minor version updates: auto-merge after CI passes, weekly batch.
• Patch updates: auto-merge within 3 days, no batch delay.
• Security fixes: immediate PR, direct assign to security team.
• Dev dependencies: weekly batch, auto-merge patch/minor.
• Direct dependencies (production): manual review for major, auto-merge for minor/patch.

Vulnerability Severity Thresholds

Severity	Response	SLA	Assignee
Critical	Emergency patch, immediate PR	24 hours	Security team
High	Prioritized patch within 7 days	7 days	Security + dev team
Medium	Patch within next release cycle	30 days	Dev team
Low	Patch within next major	90 days	Dev team

Auto-Merge Risk Assessment

Update Type	Auto-Merge	Requires	Risk Level
Patch (devDeps)	Yes	CI passes	Low
Patch (dependencies)	Yes	CI + code coverage	Low
Minor (devDeps)	Yes	CI passes	Medium
Minor (dependencies)	Conditional	CI + review if breaking	Medium
Major (any)	Never	Manual review required	High
Security (any)	Conditional	CI + security team review	High

Core Workflow

Step 1: Dependabot Configuration

version: 2
updates:
  - package-ecosystem: "npm"
    directory: "/"
    schedule:
      interval: "weekly"
      day: "monday"
      time: "09:00"
      timezone: "America/New_York"
    versioning-strategy: "increase-if-necessary"
    open-pull-requests-limit: 10
    rebase-strategy: "auto"
    labels:
      - "dependencies"
      - "npm"
    reviewers:
      - "team-devs"
    assignees:
      - "bot-owner"
    commit-message:
      prefix: "fix"
      prefix-development: "chore"
      include: "scope"
    allow:
      - dependency-type: "direct"
    ignore:
      - dependency-name: "react"
        versions: [">=19.0.0"]
      - dependency-name: "typescript"
        update-types: ["version-update:semver-major"]

  - package-ecosystem: "docker"
    directory: "/"
    schedule:
      interval: "weekly"

  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "weekly"
    groups:
      actions:
        patterns:
          - "actions/*"
          - "github/codeql-action/*"

Step 2: Renovate Configuration

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": [
    "config:recommended",
    ":dependencyDashboard",
    ":semanticCommits",
    "group:allNonMajor"
  ],
  "labels": ["dependencies", "renovate"],
  "assigneesFromCodeOwners": true,
  "schedule": ["before 9am on monday"],
  "timezone": "America/New_York",
  "rangeStrategy": "bump",
  "lockFileMaintenance": {
    "enabled": true,
    "schedule": ["before 9am on monday"]
  },
  "packageRules": [
    {
      "description": "Auto-merge patch updates",
      "matchUpdateTypes": ["patch"],
      "automerge": true,
      "automergeType": "pr",
      "platformAutomerge": true
    },
    {
      "description": "Group dev dependencies",
      "matchDepTypes": ["devDependencies"],
      "groupName": "devDependencies",
      "groupSlug": "dev"
    },
    {
      "description": "Major updates require manual review",
      "matchUpdateTypes": ["major"],
      "labels": ["major-update"],
      "assignees": ["team-lead"],
      "reviewers": ["team-lead"]
    },
    {
      "description": "Ignore certain packages",
      "matchPackageNames": ["react", "react-dom"],
      "allowedVersions": "<19.0.0"
    }
  ],
  "vulnerabilityAlerts": {
    "enabled": true,
    "labels": ["security"],
    "assignees": ["security-team"]
  },
  "prConcurrentLimit": 5,
  "prHourlyLimit": 2,
  "osvVulnerabilityAlerts": true
}

Step 3: Auto-Merge Workflow

name: Auto-merge Dependencies
on:
  pull_request:
    types: [labeled, opened, synchronize]

jobs:
  auto-merge:
    if: contains(github.event.pull_request.labels.*.name, 'automerge')
    runs-on: ubuntu-latest
    permissions:
      contents: write
      pull-requests: write
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: npm
      - run: npm ci
      - run: npm test
      - run: npm run build
      - uses: pascalgn/automerge-action@v0.16.4
        env:
          GITHUB_TOKEN: {% raw %}${{ secrets.GITHUB_TOKEN }}{% endraw %}

Step 4: Vulnerability Scanning

name: Vulnerability Scan
on:
  schedule:
    - cron: "0 6 * * *"
  push:
    branches: [main]

jobs:
  audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: npm
      - run: npm audit --audit-level=high

  sbom:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: advanced-security/sbom-generator-action@v0.0.1
        id: sbom
      - uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: ${{ steps.sbom.outputs.sbomPath }}

  trivy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: aquasecurity/trivy-action@master
        with:
          scan-type: fs
          scan-ref: .
          format: sarif
          output: trivy-results.sarif
          severity: CRITICAL,HIGH
      - uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: trivy-results.sarif

Step 5: Lock File Policy

# .gitattributes - ensure lock files are treated as binary for PR diffs
package-lock.json binary
yarn.lock binary
pnpm-lock.yaml binary
Cargo.lock binary
go.sum binary
Gemfile.lock binary

Step 6: SBOM Generation

name: SBOM Generation
on:
  push:
    branches: [main]
  schedule:
    - cron: "0 0 * * 0"

jobs:
  generate-sbom:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: CycloneDX/gh-node-module-generatebom@v2
        with:
          path: .
      - uses: actions/upload-artifact@v4
        with:
          name: sbom
          path: bom.xml

Step 7: Dependency Review in CI

name: Dependency Review
on: [pull_request]

permissions:
  contents: read

jobs:
  dependency-review:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/dependency-review-action@v4
        with:
          fail-on-severity: high
          license-check: true
          deny-licenses: GPL-3.0, AGPL-3.0
          comment-summary-in-pr: always

Anti-Patterns

Anti-Pattern 1: Ignoring Lock Files

.gitignoring lock files means builds are non-reproducible and vulnerability scans are inaccurate. Lock files are the source of truth for what is actually installed. Always commit lock files.

Anti-Pattern 2: Auto-Merging Major Updates

Major version bumps often contain breaking API changes that break builds silently. Auto-merging bypasses review. Always require manual review for major version updates.

Anti-Pattern 3: No Vulnerability Alerting

Without vulnerability scanning and alerting, critical security patches go unnoticed. An unpatched CVE in a production dependency can lead to exploitation. Enable and monitor vulnerability alerts.

Anti-Pattern 4: Not Pinning GitHub Actions

Using @v1 or @main for GitHub Actions means the action can change without notice, potentially breaking CI or introducing supply chain vulnerabilities. Pin to SHA or full semver tag.

Anti-Pattern 5: Too Many Open PRs

Dependabot or Renovate opens 50+ PRs overwhelming CI and reviewers. Set open-pull-requests-limit or prConcurrentLimit. Use grouped updates to reduce PR count.

Anti-Pattern 6: Ignoring Transitive Dependencies

Auditing only direct dependencies misses vulnerabilities in transitive dependencies. Use npm audit, Dependabot alerts (which scan the full tree), or Renovate vulnerability alerts with OSV.

Anti-Pattern 7: No Update Schedule

Running updates daily creates noise. Running updates monthly misses critical security patches. Weekly schedule with security alerts on-demand is the recommended balance.

Production Considerations

Supply Chain Security

• Pin all dependency versions (never ranges like ^1.2.3 in production).
• Use lock files for deterministic installs.
• Sign commits and tags from Dependabot/Renovate.
• Scan for malicious packages (Socket.dev, npm audit, Snyk).
• Maintain an SBOM for every release.
• Enable Dependabot security updates for critical and high alerts.

CI Integration

• Run npm audit / pip audit in CI on every PR.
• Fail CI on critical and high vulnerabilities.
• Block PRs that add dependencies with known vulnerabilities.
• Require SBOM generation in release pipeline.
• Validate dependency licenses in CI.

Monorepo Strategy

• One Dependabot config per monorepo with per-directory updates.
• Renovate auto-detects workspaces (npm, pnpm, lerna).
• Use Renovate packageRules with matchFileNames for subdirectories.
• Group updates by workspace to reduce PR count.

Rules

• Always commit lock files -- never .gitignore them.
• Never auto-merge major version updates without manual review.
• Pin GitHub Action versions to SHA for supply chain security.
• Enable vulnerability alerts for all production dependencies.
• Use grouped updates (Renovate) or allow rules (Dependabot) to reduce PR noise.
• Set open-pull-requests-limit / prConcurrentLimit to avoid overwhelming CI.
• Configure schedule during business hours to avoid weekend CI usage.
• Use Renovate presets for org-wide standardization.
• Enable lock file maintenance for regular lock file updates.
• Use dependency review action in CI to block vulnerable PRs.
• Maintain SBOM for compliance and incident response.
• Set vulnerability SLA: critical = 24h, high = 7d, medium = 30d.
• Use OSV database for comprehensive vulnerability coverage.

Compared With

Dependabot vs Renovate vs Manual

Dependabot: simplest setup, GitHub-native, limited customization. Renovate: more configurable, grouped updates, regex manager, self-hostable. Manual: outdated immediately, no vulnerability alerting, human error prone. Start with Dependabot for simple projects, Renovate for complex monorepos.

npm audit vs Snyk vs Trivy

npm audit: built-in, free, limited to npm ecosystem. Snyk: broader language coverage, fix PRs, license checks, paid. Trivy: open-source, fast, covers filesystem, containers, repos, SBOM. Use npm audit as baseline, Trivy for CI scanning, Snyk for enterprise.

Lock Files by Ecosystem

npm (package-lock.json): npm standard, deterministic. yarn (yarn.lock): yarn specific. pnpm (pnpm-lock.yaml): pnpm specific, efficient disk. Cargo.lock: Rust standard. go.sum: Go standard, checksum only. Gemfile.lock: Ruby standard. poetry.lock: Python poetry.

Operations & Maintenance

Weekly Tasks

• Review open dependency PRs and merge safe ones.
• Check vulnerability alerts and update SLAs.
• Monitor Renovate/Dependabot dashboard for issues.

Monthly Tasks

• Review update configuration for new ecosystems.
• Update Renovate/Dependabot to latest version.
• Audit SBOM generation outputs.

Quarterly Tasks

• Review dependency licensing.
• Audit transitive dependency footprint.
• Update dependency policies based on new supply chain threats.
• Test rollback of dependency update scenarios.

References

• references/dependabot-setup.md -- Dependabot Setup
• references/dependency-management-advanced.md -- Dependency Management Advanced Topics
• references/dependency-management-fundamentals.md -- Dependency Management Fundamentals
• references/renovate-config.md -- Renovate Configuration
• references/update-strategies.md -- Update Strategies
• references/vulnerability-scanning.md -- Vulnerability Scanning

Handoff

After completing this skill:

• Next skill: monorepo -- workspace dependency graph, internal packages
• Pass context: Dependabot/Renovate config, update schedules, security policies

Architecture Decision Trees

Automated vs Manual Updates

Decision	Automated (Dependabot/Renovate)	Manual Updates
Update frequency	Daily/Weekly PRs	Quarterly releases
Breaking changes	Automated major bump PRs	Manual review per package
CI requirement	Must pass test suite per PR	Full regression suite
Team size	Any	Small teams (< 5)
Risk profile	Low to moderate	High (accumulated drift)
Maintenance burden	Low (bot handles PRs)	High (scheduled upgrade weeks)

Monorepo vs Polyrepo Dependency Strategy

Aspect	Monorepo	Polyrepo
Shared dep updates	Single lockfile, atomic	Per-repo, coordinated releases
Version conflicts	Single version constraint	Multiple, drift possible
CI complexity	Single pipeline	N pipelines, matrix builds
Publishing	Internal packages first	External registry needed

Implementation Patterns

YAML: Renovate Configuration for Monorepo

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": [
    "config:base",
    ":separateMajorMinor",
    ":combinePatchMinorUpdates",
    "group:monorepos",
    "schedule:weekly"
  ],
  "packageRules": [
    {
      "matchUpdateTypes": ["minor", "patch"],
      "matchCurrentVersion": ">=1.0.0",
      "automerge": true,
      "automergeType": "pr",
      "platformAutomerge": true
    },
    {
      "matchDepTypes": ["devDependencies"],
      "automerge": true,
      "schedule": ["before 9am on Monday"]
    },
    {
      "matchPackageNames": ["react", "react-dom"],
      "groupName": "React Core",
      "labels": ["frontend", "react"]
    },
    {
      "matchManagers": ["dockerfile"],
      "enabled": true,
      "schedule": ["before 9am on Monday"]
    }
  ],
  "vulnerabilityAlerts": {
    "enabled": true,
    "labels": ["security"]
  },
  "lockFileMaintenance": {
    "enabled": true,
    "schedule": ["before 9am on Monday"]
  }
}

Bash: Dependency Audit Script

#!/usr/bin/env bash
set -euo pipefail

audit_dependencies() {
  local manifest=$1

  case "$manifest" in
    package.json)
      npm audit --json > audit-report.json
      jq '.vulnerabilities | to_entries | map(select(.value.severity == "critical")) | length' audit-report.json
      ;;
    pom.xml)
      mvn org.owasp:dependency-check-maven:check \
        -DfailBuildOnCVSS=7 \
        -Dformat=JSON
      ;;
    requirements.txt)
      pip-audit --desc on --format json > audit-report.json
      ;;
  esac
}

Production Considerations

• Use lockfiles (package-lock.json, poetry.lock, requirements.txt hashes) to pin transitive deps
• Configure Dependency Dashboard in Renovate to track all pending updates in one place
• Set update schedules to avoid peak hours: schedule:before 9am on Monday
• Implement canary deploys after major dependency upgrades to catch regressions in production
• Monitor deprecation warnings from package registries and plan migrations proactively
• Keep a dependency changelog to communicate breaking changes to downstream consumers
• Use internal package registries (Verdaccio, JFrog Artifactory) to cache external dependencies

Anti-Patterns

• Using latest tags in Docker or npm — always pin to exact semver ranges
• Ignoring peer dependency warnings — they cause runtime failures in shared libraries
• Running npm update without review — batch updates hide breaking changes
• Excluding transitive dependencies from security scanning — vulnerabilities hide in nested deps
• Keeping abandoned packages as dependencies — removes the ability to get security patches
• Mixing lockfiles across environments — commit the lockfile and regenerate on CI
• Applying automated patches without running the full test suite — causes silent regressions

Performance Optimization

• Use npm ci instead of npm install in CI for deterministic, faster installs (skips resolution)
• Implement tree-shaking via bundler configuration to eliminate unused dependencies
• Deduplicate versions with npm dedupe or Yarn constraints to reduce bundle size
• Enable pnpm or Yarn PnP (Plug'n'Play) for faster installs and less disk usage
• Configure dependency caching in CI pipelines to skip re-downloading unchanged packages
• Use sub-imports / deep imports to import only needed modules instead of entire libraries
• Split monorepo packages into granular modules so consumers only install what they use

Security Considerations

• Enable Dependabot security alerts and auto-merge only patch-level security fixes
• Scan SBOM (SPDX/CycloneDX) against NVD database in every CI pipeline
• Rotate npm/GitHub tokens with minimal scopes (read:packages, no write access on CI)
• Use .npmrc with engine-strict=true and ignore-scripts=false to block postinstall exploits
• Implement package signing verification for internal packages with Sigstore
• Monitor supply chain attacks by reviewing new dependency maintainers and recent commits
• Block known malicious packages with blocklists in the internal registry proxy