dependency-management
について
このClaudeスキルは、再現可能なビルド、サプライチェーンセキュリティ、安定性を確保するために、すべてのパッケージマネージャーで正確なバージョン依存関係のインストールを強制します。package.json、requirements.txt、go.modなどの依存関係ファイルを扱う際、パッケージのインストール/更新時、またはCI/CDパイプラインの設定時にご利用ください。本スキルはロックファイルを必須とし、バージョン範囲の指定を禁止し、インストール前のセキュリティ監査を要求します。
クイックインストール
Claude Code
推奨/plugin add https://github.com/KubrickCode/ai-config-toolkitgit clone https://github.com/KubrickCode/ai-config-toolkit.git ~/.claude/skills/dependency-managementこのコマンドをClaude Codeにコピー＆ペーストしてスキルをインストールします
ドキュメント
Dependency Management
Basic Principles
Always Use Exact Versions
- 고정 버전만 사용:
[email protected] - 금지:
^1.2.3,~1.2.3,latest,*, version ranges - 예외: 라이브러리 peerDependencies만 허용
Lock Files Are Mandatory
- 항상 버전 관리에 커밋
- 수동 편집 금지
- CI/CD는 frozen/locked 모드 필수
Security Audit First
- 설치 전 취약점 확인
- 정기 감사 자동화
Installation Commands
# Node.js
npm install --save-exact [email protected]
pnpm add --save-exact [email protected]
yarn add --exact [email protected]
# Python
pip install package==1.2.3
poetry add [email protected]
# Go
go get [email protected]
# Rust
cargo add package@=1.2.3
# PHP
composer require vendor/package:1.2.3
# Ruby (Gemfile)
gem 'package', '1.2.3'
# Java/Kotlin
implementation("group:artifact:1.2.3") # Gradle
<version>1.2.3</version> # Maven
# .NET
dotnet add package PackageName --version 1.2.3
CI/CD Commands
npm ci # npm
pnpm install --frozen-lockfile # pnpm
yarn install --frozen-lockfile # yarn
poetry install --no-update # poetry
go mod verify # go
cargo build --locked # rust
composer install --no-update # php
bundle install --frozen # ruby
dotnet restore --locked-mode # .NET
Common Mistakes
| ❌ 잘못된 사용 | ✅ 올바른 사용 |
|---|---|
npm install (CI) | npm ci |
package@latest | [email protected] |
package@^1.2.3 | [email protected] |
| Lock 파일 .gitignore | Lock 파일 커밋 |
| Lock 파일 수동 편집 | 패키지 매니저로 재생성 |
GitHub リポジトリ
関連スキル
content-collections
メタThis skill provides a production-tested setup for Content Collections, a TypeScript-first tool that transforms Markdown/MDX files into type-safe data collections with Zod validation. Use it when building blogs, documentation sites, or content-heavy Vite + React applications to ensure type safety and automatic content validation. It covers everything from Vite plugin configuration and MDX compilation to deployment optimization and schema validation.
creating-opencode-plugins
メタThis skill provides the structure and API specifications for creating OpenCode plugins that hook into 25+ event types like commands, files, and LSP operations. It offers implementation patterns for JavaScript/TypeScript modules that intercept and extend the AI assistant's lifecycle. Use it when you need to build event-driven plugins for monitoring, custom handling, or extending OpenCode's capabilities.
polymarket
メタThis skill enables developers to build applications with the Polymarket prediction markets platform, including API integration for trading and market data. It also provides real-time data streaming via WebSocket to monitor live trades and market activity. Use it for implementing trading strategies or creating tools that process live market updates.
cloudflare-turnstile
メタThis skill provides comprehensive guidance for implementing Cloudflare Turnstile as a CAPTCHA-alternative bot protection system. It covers integration for forms, login pages, API endpoints, and frameworks like React/Next.js/Hono, while handling invisible challenges that maintain user experience. Use it when migrating from reCAPTCHA, debugging error codes, or implementing token validation and E2E tests.