dependency-management
について
このClaude Skillは、再現可能なビルド、サプライチェーンセキュリティ、安定性を確保するために、すべてのパッケージマネージャーで固定バージョンの依存関係インストールを実施します。package.jsonやrequirements.txtなどの設定ファイルを扱う際のパッケージインストール、依存関係の更新、設定作業に関するガイダンスを提供します。依存関係設定のレビュー時やCI/CDパイプラインの設定時に本Skillをご利用いただくことで、一貫性のある依存関係管理プラクティスを維持できます。
クイックインストール
Claude Code
推奨/plugin add https://github.com/KubrickCode/ai-config-toolkitgit clone https://github.com/KubrickCode/ai-config-toolkit.git ~/.claude/skills/dependency-managementこのコマンドをClaude Codeにコピー&ペーストしてスキルをインストールします
ドキュメント
Dependency Management
Basic Principles
Always Use Exact Versions
- Use exact versions only:
[email protected] - Forbid:
^1.2.3,~1.2.3,latest,*, version ranges - Exception: Library peerDependencies only
Lock Files Are Mandatory
- Always commit to version control
- Forbid manual editing
- CI/CD must use frozen/locked mode
Security Audit First
- Check vulnerabilities before installation
- Automate regular audits
Installation Commands
# Node.js
npm install --save-exact [email protected]
pnpm add --save-exact [email protected]
yarn add --exact [email protected]
# Python
pip install package==1.2.3
poetry add [email protected]
# Go
go get [email protected]
# Rust
cargo add package@=1.2.3
# PHP
composer require vendor/package:1.2.3
# Ruby (Gemfile)
gem 'package', '1.2.3'
# Java/Kotlin
implementation("group:artifact:1.2.3") # Gradle
<version>1.2.3</version> # Maven
# .NET
dotnet add package PackageName --version 1.2.3
CI/CD Commands
npm ci # npm
pnpm install --frozen-lockfile # pnpm
yarn install --frozen-lockfile # yarn
poetry install --no-update # poetry
go mod verify # go
cargo build --locked # rust
composer install --no-update # php
bundle install --frozen # ruby
dotnet restore --locked-mode # .NET
Common Mistakes
| ❌ Wrong | ✅ Correct |
|---|---|
npm install (CI) | npm ci |
package@latest | [email protected] |
package@^1.2.3 | [email protected] |
| Lock file in .gitignore | Commit lock file |
| Manual lock file editing | Regenerate via package manager |
GitHub リポジトリ
関連スキル
content-collections
メタThis skill provides a production-tested setup for Content Collections, a TypeScript-first tool that transforms Markdown/MDX files into type-safe data collections with Zod validation. Use it when building blogs, documentation sites, or content-heavy Vite + React applications to ensure type safety and automatic content validation. It covers everything from Vite plugin configuration and MDX compilation to deployment optimization and schema validation.
creating-opencode-plugins
メタThis skill provides the structure and API specifications for creating OpenCode plugins that hook into 25+ event types like commands, files, and LSP operations. It offers implementation patterns for JavaScript/TypeScript modules that intercept and extend the AI assistant's lifecycle. Use it when you need to build event-driven plugins for monitoring, custom handling, or extending OpenCode's capabilities.
evaluating-llms-harness
テストThis Claude Skill runs the lm-evaluation-harness to benchmark LLMs across 60+ standardized academic tasks like MMLU and GSM8K. It's designed for developers to compare model quality, track training progress, or report academic results. The tool supports various backends including HuggingFace and vLLM models.
sglang
メタSGLang is a high-performance LLM serving framework that specializes in fast, structured generation for JSON, regex, and agentic workflows using its RadixAttention prefix caching. It delivers significantly faster inference, especially for tasks with repeated prefixes, making it ideal for complex, structured outputs and multi-turn conversations. Choose SGLang over alternatives like vLLM when you need constrained decoding or are building applications with extensive prefix sharing.
