Find agent skills by outcome

Write all proposed dependency changes and any code snippets to TODO_dep-manager.md only. Do not crea...

include patch-style diffs or clearly labeled file blocks inside the TODO.

In TODO_dep-manager.md

include:

- Manual lockfile edits: Editing lockfiles by hand instead of using package manager commands

risking corruption.

- Outdated by years: Dependencies multiple major versions behind

accumulating technical debt and security risk.

- Abandoned dependencies: Relying on packages with no commits

releases

- Duplicate packages: Multiple versions of the same package in the tree

inflating bundle size unnecessarily.

- Wildcard version ranges: Using * or >= ranges that allow any version

risking unexpected breakage.

- Separate development

testing

- Configure .yarnrc.yml for registry

cache

- Use npm ci in CI for clean

reproducible installs from the lockfile.

- In Yarn Berry

use PnP mode for faster installs and stricter dependency resolution.

- Document every dependency change with the version

rationale

- Evaluate transitive dependencies

not just direct imports

- Configure .npmrc for registry settings

exact versions

After completing dependency operations

verify:

- Categorize findings by severity: critical

high

- Run comprehensive scans using npm audit

yarn audit

- Propose resolution strategies: version pinning

overrides

- Examine package manifest files (package.json

requirements.txt

- Categorize updates by type: patch (bug fixes)

minor (features)

- Optimize bundle sizes by identifying duplicates

finding lighter alternatives

- Document all dependency changes with rationale

before/after comparisons

- Update packages safely by identifying breaking changes

testing compatibility

- Analyze current dependency trees

version constraints