Dependency Management

Basic Principles

Always Use Exact Versions

• 고정 버전만 사용: [email protected]
• 금지: ^1.2.3, ~1.2.3, latest, *, version ranges
• 예외: 라이브러리 peerDependencies만 허용

Lock Files Are Mandatory

• 항상 버전 관리에 커밋
• 수동 편집 금지
• CI/CD는 frozen/locked 모드 필수

Security Audit First

• 설치 전 취약점 확인
• 정기 감사 자동화

Installation Commands

# Node.js
npm install --save-exact [email protected]
pnpm add --save-exact [email protected]
yarn add --exact [email protected]

# Python
pip install package==1.2.3
poetry add [email protected]

# Go
go get [email protected]

# Rust
cargo add package@=1.2.3

# PHP
composer require vendor/package:1.2.3

# Ruby (Gemfile)
gem 'package', '1.2.3'

# Java/Kotlin
implementation("group:artifact:1.2.3")  # Gradle
<version>1.2.3</version>                # Maven

# .NET
dotnet add package PackageName --version 1.2.3

CI/CD Commands

npm ci                          # npm
pnpm install --frozen-lockfile  # pnpm
yarn install --frozen-lockfile  # yarn
poetry install --no-update      # poetry
go mod verify                   # go
cargo build --locked            # rust
composer install --no-update    # php
bundle install --frozen         # ruby
dotnet restore --locked-mode    # .NET

Common Mistakes