“dependency”的搜索结果

检查Python和JavaScript依赖文件中的版本约束缺失、重复条目、固定版本冲突及过时兼容包，用易懂的语言说明影响并提出便于核对的修改建议。

• 安装失败深入排查前的初步检查
• 检查过时的Python兼容包
• 检查重复条目和固定版本冲突

Find dependency confusion risks, where a public package can replace an internal package with the same name. Review dependency files, identify exposed names, and guide registry restrictions and recurring CI checks to prevent substitution.

中文简介正在准备中。当前显示英语简介。

• Auditing projects that mix private and public package registries
• Checking exposure after internal package names have leaked
• Restricting package sources to approved private registries

Screen dependency names on npm, PyPI, and crates.io before installation to find lookalikes of legitimate packages. This skill compares spelling patterns and registry metadata, helping review AI-generated lists, lockfile changes, and new dependencies in CI/CD.

中文简介正在准备中。当前显示英语简介。

• Screening a new dependency before installation
• Reviewing dependency lists generated by AI
• Checking lockfile changes for swapped packages

Review dependency manifests and lockfiles to find outdated packages and known security vulnerabilities. Group proposed updates by version change, report current and suggested versions, and identify updates that need human review.

中文简介正在准备中。当前显示英语简介。

• Reviewing outdated dependencies
• Checking known vulnerabilities and update options
• Separating patch, minor, and major updates

Assess dependency confusion, where a build retrieves a public package instead of an intended private one. Discover internal package names, review registry settings, plan callback-based proofs of execution, and document fixes across major package ecosystems.

中文简介正在准备中。当前显示英语简介。

• Reviewing package registry settings in CI/CD
• Finding internal package names in lock files
• Planning an authorized callback-based proof of concept

Assess weaknesses in the software supply chain, from dependency packages to build pipelines and distributed artifacts. Covers authorized proof-of-concept testing, package confusion, container image risks, signing abuse, and defensive checks for tampering.

中文简介正在准备中。当前显示英语简介。

• Assess dependency confusion risks in package registry settings
• Review tampering risks in CI/CD artifacts and container images
• Plan a non-destructive proof of concept and remediation report

为 TypeScript 项目配置包边界检查，检测外部对包内部文件的直接引用和循环依赖。以包根目录文件作为公开入口，并完成示例、验证和文档。

• 防止直接引用包内部文件
• 在类型检查时一并检查包边界
• 创建可复制的包模板

Complete a Dependabot update across a monorepo by updating matching dependency versions in other packages and regenerating bun.lock. Check the changed files, preserve existing version prefixes, then commit and push the fixes.

中文简介正在准备中。当前显示英语简介。

• Completing a partial Dependabot dependency update
• Updating the same dependency across multiple packages
• Regenerating bun.lock after a version update

Audit dependency files across eight language ecosystems for built-in vulnerability patterns, license conflicts, and indirect dependency risks. Generate a prioritized upgrade plan with testing and rollback notes, and pair results with live audit tools for current vulnerability coverage.

中文简介正在准备中。当前显示英语简介。

• Auditing third-party packages before a release
• Checking dependencies against built-in CVE patterns
• Reviewing license conflicts across dependency chains

Set up dependency-cruiser in a TypeScript repository to enforce package boundaries: outside code uses public entry files while implementation stays in subfolders. Add checks, a starter package, and documentation, then verify that forbidden imports fail.

中文简介正在准备中。当前显示英语简介。

• Preventing imports into package internals
• Adding boundary checks to existing validation commands
• Creating a starter package with public entry files

Use when planning, implementing, or reviewing frontend dependency upgrades, package migrations, lockfile changes, major framework version bumps, CVE remediation, peer dependency conflicts, ESM/CJS shifts, build-tool compatibility, or CI verification matrices; Chinese triggers include dependency upgrades, version upgrades, lockfile, peer dependency, CVE fixes, major version migrations.

中文简介正在准备中。当前显示原文说明。

Check third-party packages for known security vulnerabilities, review dependency versions and lock files, and plan updates or replacements. The skill also guides automated scanning in CI, the pipeline that runs project checks.

中文简介正在准备中。当前显示英语简介。

• Checking dependencies before a production deployment
• Investigating a reported package vulnerability
• Adding automated dependency scanning to CI

Connect CommunityToolkit.Mvvm ViewModels to Microsoft.Extensions.DependencyInjection, which supplies their required services. Get guidance on startup setup, instance lifetimes, messaging, view integration, and replacing dependencies in tests across supported .NET user interface frameworks.

中文简介正在准备中。当前显示英语简介。

• Set up dependency injection in a new XAML app
• Choose shared or per-page service instances
• Diagnose missing service registration errors

Configure GitHub Dependabot to keep dependencies, the packages a project relies on, updated. Organize update pull requests into groups, set schedules and exclusion rules, and configure security updates across projects with multiple packages or package systems.

中文简介正在准备中。当前显示英语简介。

• Create or revise dependabot.yml
• Group dependency updates into fewer pull requests
• Configure updates across a monorepo

Inspect npm packages and dependency files for malicious installation scripts, credential theft, and self-spreading behavior. Use GuardDog scanning, source inspection, known-malicious version checks, and isolated execution to produce an evidence-based assessment.

中文简介正在准备中。当前显示英语简介。

• Vetting a new npm dependency before adoption
• Reviewing dependency files during code review
• Checking lockfiles against known-malicious versions

Update outdated project packages on an isolated branch, handle changes that break compatibility, and run installation, code checks, builds, tests, and security audits. Open a pull request only after every required check passes, with deferred upgrades recorded.

中文简介正在准备中。当前显示英语简介。

• Run a weekly dependency update sweep
• Plan migrations for major package upgrades
• Create an update pull request after verification

Review dependency files to find outdated packages and security vulnerabilities. Sort updates by severity and version change, identify cases needing human review, and record a prioritized update list with testing requirements.

中文简介正在准备中。当前显示英语简介。

• Prioritizing outdated dependencies
• Separating security fixes by severity
• Identifying major updates needing human review

Configure dependency injection in .NET MAUI, a way to supply objects with the services they need. Covers service registration, instance lifetimes, page and ViewModel constructors, Shell navigation, platform implementations, and test substitutions.

中文简介正在准备中。当前显示英语简介。

• Register services, Pages, and ViewModels
• Choose shared or freshly created service instances
• Connect Shell navigation with constructor injection

Review dependency handling, package downloads, credentials, and deployed file cleanup in APM. The skill defines checks for safe paths, centralized credential access, and refusing content when its integrity or signature cannot be verified.

中文简介正在准备中。当前显示英语简介。

• Reviewing dependency resolution and lockfile changes
• Checking package integrity and signature verification
• Inspecting token handling for possible leaks

Dependency management for Golang projects — go.mod and go.sum, `go get` install and upgrade flows, Minimal Version Selection, conflict resolution with replace/exclude/retract, `govulncheck` scanning of the module tree, outdated dependency and binary size auditing, vendoring, `tool` directives, and go.work workspaces. Use when adding, removing, or upgrading Go dependencies, deciding whether to take on a package, resolving version conflicts, or auditing what a module pulls in. Covers choosing and upgrading dependency versions, not the surrounding tooling: do NOT use for fixing an exploitable vulnerability in code (→ See `samber/cc-skills-golang@golang-security` skill) or for wiring Dependabot/Renovate update bots into CI workflows (→ See `samber/cc-skills-golang@golang-continuous-integration` skill).

中文简介正在准备中。当前显示原文说明。

Manage third-party libraries, runtimes, and SaaS dependencies. Use this skill when setting an update cadence, responding to security advisories, dealing with deprecated dependencies, evaluating new dependencies, auditing what's installed, or unblocking a dependency upgrade. Triggers on dependency, package update, security patch, lockfile, deprecated, breaking change, supply chain, dependency audit, npm audit, dependabot, renovate. Also triggers when a build breaks after an update or when an advisory is published for a used package.

中文简介正在准备中。当前显示原文说明。

Audit and reduce JavaScript package dependency footprint across npm, pnpm, Yarn, and Bun projects. Use when asked to remove unused dependencies, deduplicate workspace dependency versions, lockfiles or node_modules, analyze direct dependencies' transitive lockfile closure, find low-risk upgrades that reduce dependency trees, inline trivial dependencies, or apply e18e dependency replacement recommendations.

中文简介正在准备中。当前显示原文说明。

Identify, analyze, and manage software dependencies before deployment. Use this skill when preparing applications for deployment, resolving dependency conflicts, updating dependencies, auditing security vulnerabilities, managing package versions, or troubleshooting dependency-related issues. Supports multiple package managers (npm, pip, maven, cargo, go mod, composer) and provides actionable recommendations for dependency management.

中文简介正在准备中。当前显示原文说明。

Provides dependency management and supply chain security practices for auditing vulnerabilities, checking licenses, assessing dependency health, and managing upgrades safely. Use when auditing packages, reviewing security, managing dependencies, or when user mentions 'audit', 'vulnerability', 'dependency', 'supply chain', 'npm audit', 'license', 'bundle size'.

中文简介正在准备中。当前显示原文说明。