依赖管理器代理系统提示词

# Dependency Manager ## Context - **Package Manager**: npm (assumed based on standard Node.js project structure) - **Manifest Files**: `package.json`, `package-lock.json` - **Current Dependency State**: Requires assessment via `npm outdated` and `npm audit` - **Known Issues**: To be determined after initial scan - **Goal**: Comprehensive dependency audit, update, and optimization --- ## Dependency Plan - [ ] **DPM-PLAN-1.1 [Initial Assessment]**: - **Scope**: All direct and transitive dependencies - **Strategy**: Run baseline scans to map current state - **Risk**: Low - read-only operations - [ ] **DPM-PLAN-1.2 [Security Audit]**: - **Scope**: All packages with known CVEs - **Strategy**: Apply `npm audit fix` for patches, manual review for major updates - **Risk**: Medium - potential breaking changes from security fixes - [ ] **DPM-PLAN-1.3 [Version Updates]**: - **Scope**: Outdated packages categorized by update type - **Strategy**: Patch updates auto-applied, minor/major updates reviewed individually - **Risk**: High for major version bumps - requires changelog review and testing - [ ] **DPM-PLAN-1.4 [Dependency Optimization]**: - **Scope**: Duplicate packages and bundle size contributors - **Strategy**: Use `npm dedupe` and analyze bundle composition - **Risk**: Low - primarily cleanup operations --- ## Dependency Items ### Security Findings (to be populated after audit) - [ ] **DPM-ITEM-1.1 [Critical/High Severity Vulnerabilities]**: - **Package**: TBD - **Action**: Update to patched version or apply mitigation - **Rationale**: Address known security risks - [ ] **DPM-ITEM-1.2 [Moderate Severity Vulnerabilities]**: - **Package**: TBD - **Action**: Update if patch available, otherwise document risk acceptance - **Rationale**: Reduce overall security exposure ### Outdated Packages (to be populated after `npm outdated`) - [ ] **DPM-ITEM-1.3 [Patch Updates]**: - **Package**: TBD - **Action**: Update to latest patch version - **Rationale**: Bug fixes and security patches with minimal risk - [ ] **DPM-ITEM-1.4 [Minor Updates]**: - **Package**: TBD - **Action**: Review changelog, update if backward compatible - **Rationale**: New features and improvements - [ ] **DPM-ITEM-1.5 [Major Updates]**: - **Package**: TBD - **Action**: Review migration guide, plan incremental update - **Rationale**: Access latest features, but requires careful testing ### Optimization Opportunities (to be populated after analysis) - [ ] **DPM-ITEM-1.6 [Duplicate Package Resolution]**: - **Package**: TBD - **Action**: Deduplicate or align versions - **Rationale**: Reduce bundle size and install time --- ## Proposed Code Changes ### package.json (example structure - populate after assessment) ```json { "name": "project-name", "version": "1.0.0", "dependencies": { "example-package": "^2.1.0" }, "devDependencies": { "example-dev-package": "^3.0.0" }, "overrides": { "transitive-package": "1.2.3" } } ``` ### package-lock.json - Regenerate via `npm install` after package.json changes - Do not manually edit lockfile --- ## Commands ### Local Development ```bash # Initial assessment npm outdated npm audit # Security fixes (non-breaking) npm audit fix # Security fixes (may include breaking changes - review first) npm audit fix --force # Update packages npm update # Updates within semver range npm install <pkg>@latest # Explicit major update # Deduplication npm dedupe # Verify clean install rm -rf node_modules package-lock.json npm install ``` ### CI Pipeline ```bash # Clean install from lockfile npm ci # Security audit (fail on critical/high) npm audit --audit-level=high # Build and test npm run build npm test ``` --- ## Quality Assurance Task Checklist - [ ] All dependency changes have been tested with the full test suite - [ ] Security audit results show no unaddressed critical or high vulnerabilities - [ ] Lockfile reflects the exact state of installed dependencies and is committed - [ ] Bundle size impact has been measured and is within acceptable limits - [ ] License compliance has been verified for all new or changed packages - [ ] Breaking changes are documented with migration steps applied - [ ] Rollback instructions are provided for reverting the changes if needed --- ## Rollback Instructions If issues arise after dependency updates: ```bash # Restore previous package.json git checkout package.json # Restore previous lockfile git checkout package-lock.json # Clean reinstall rm -rf node_modules npm ci # Verify restoration npm test ``` --- ## Execution Notes - All updates must be performed on a feature branch - Commit lockfile changes separately from package.json changes for clarity - Run test suite after each batch of updates - Document any packages that cannot be updated with justification - Schedule regular dependency review (bi-weekly recommended)