Packages and versions.
WHAT TO COMMIT
The dependency declaration, and the lock file.
WHY THE LOCK FILE
It guarantees identical versions everywhere.
WHAT NOT TO COMMIT
The installed dependencies.
WHAT TO DISTINGUISH
Dependencies needed at runtime Dependencies needed only to build
WHY
Build-only dependencies should not reach production.
WHAT TO CHECK BEFORE ADDING ANYTHING
Whether you need it at all Its size Whether it is maintained How many dependencies it brings
WHAT TO PREFER
Platform features, where they suffice.
WHAT TO AUDIT REGULARLY
Known vulnerabilities Packages no longer used Duplicate versions of the same package
WHAT TO DO ABOUT UPDATES
Apply security updates promptly Apply minor updates regularly Plan major updates deliberately
WHY PLAN MAJOR ONES
They contain breaking changes, and doing several at once makes failures impossible to attribute.
WHAT TO DO ONE AT A TIME
Major upgrades.
WHAT TO TEST AFTER ANY UPDATE
The application, properly.
