dependency management for cargo and npm

📦 Dependency Management

Version: 2.0.0 Last Updated: 2025-11-22 Priority: ⭐⭐⭐ (P2 Level) Purpose: Adding, updating, and auditing Cargo/npm dependencies

---

📋 Overview

Provides dependency management, version conflict resolution, and security auditing for Rust (Cargo) and Node.js (npm).

---

🎯 P0: Invocation Triggers

Trigger	Example
Dependency update	"update dependencies"
Version conflict	"why is there a version conflict?"
Add dependency	"add a new dependency"
Regular update	"weekly/monthly dependency updates"

---

🔧 P1: Command List

Cargo（Rust）

Command	Purpose	Frequency
cargo add <crate>	Add dependency	Medium
cargo update	Update all dependencies	Weekly
cargo update -p <crate>	Specific update	As needed
cargo tree	Dependency tree	During investigation
cargo audit	Security audit	Weekly
cargo-udeps	Unused detection	Monthly

npm（Node.js）

Command	Purpose	Frequency
npm install <pkg>	Add dependency	Medium
npm update	Update all dependencies	Weekly
npm audit	Security audit	Weekly
npm outdated	Check outdated dependencies	Monthly

---

🚀 P2: Update Strategy

Update Frequency Guidelines

Version	Frequency	Risk	Example
Patch (x.x.Y)	Weekly	Low	1.0.0 → 1.0.1
Minor (x.Y.0)	Monthly	Medium	1.0.0 → 1.1.0
Major (Y.0.0)	Quarterly	High	1.0.0 → 2.0.0

Pattern 1: Safe update

# Step 1: 現状確認
cargo outdated

# Step 2: Patch更新（安全）
cargo update

# Step 3: テスト
cargo test --all

# Step 4: 監査
cargo audit

Pattern 2: Specific crate update

# 特定クレートのみ
cargo update -p tokio

# バージョン指定（Cargo.toml）
[dependencies]
tokio = "1.35"  # 1.35.x の最新

Pattern 3: Dependency tree investigation

# 全体ツリー
cargo tree

# 特定クレートの依存元
cargo tree -i tokio

# 重複検出
cargo tree -d

---

⚡ P3: Version Conflict Resolution

Conflict Patterns

Pattern	Symptom	Solution
Multiple versions	cargo tree -d detected with	Unified version specification
Incompatible feature	Compile error	Feature adjustment
Circular dependency	Link error	Review dependency structure

Resolution Example

# Cargo.toml - バージョン統一
[workspace.dependencies]
tokio = { version = "1.35", features = ["full"] }

[dependencies]
tokio = { workspace = true }

# feature競合確認
cargo tree -f "{p} {f}"

---

📊 Workspace Dependency Management

Recommended Structure

# ルート Cargo.toml
[workspace]
members = ["crates/*"]

[workspace.dependencies]
tokio = { version = "1", features = ["full"] }
serde = { version = "1", features = ["derive"] }

# crates/miyabi-core/Cargo.toml
[dependencies]
tokio = { workspace = true }
serde = { workspace = true }

---

🛡️ Security Audit

Automated Audit Setup

# 監査実行
cargo audit

# 修正可能な脆弱性を自動修正
cargo audit fix

# CI用（失敗時に終了）
cargo audit --deny warnings

Unused Dependency Detection

# インストール
cargo install cargo-udeps

# 実行（nightly必要）
cargo +nightly udeps

---

✅ Success Criteria

Check Item	Criteria
cargo audit	0 vulnerabilities
cargo tree -d	Minimal duplication
cargo-udeps	No unused
Build	Success
Test	All pass

---

🔗 Related Skills

• Rust Development: Build verification
• Security Audit: Vulnerability response
• Git Workflow: Update commit