Reproducible installs.
WHAT TO COMMIT
The declaration of what you require The lock file recording exactly what was installed
WHY THE LOCK FILE
It guarantees identical versions everywhere.
WHAT TO RUN IN A PIPELINE
Installation from the lock file, never an update.
WHY
An update changes versions unpredictably, so the build tests something different from what you deploy.
WHAT TO CACHE
The downloaded dependencies, keyed on the lock file.
WHY KEYED ON IT
So the cache is invalidated when dependencies change.
WHAT TO CHECK AUTOMATICALLY
Known vulnerabilities in your dependencies.
WHAT TO DO ABOUT FINDINGS
Update promptly for anything serious.
WHAT TO SCHEDULE
A regular update, deliberately, with tests run afterwards.
WHY DELIBERATELY
Unattended updates break things at unpredictable times.
WHAT TO REVIEW PERIODICALLY
Dependencies no longer maintained Dependencies you no longer use
WHAT TO REMOVE
Anything unused. Every dependency is exposure and maintenance.
WHAT TO EXCLUDE IN PRODUCTION BUILDS
Development dependencies.
