Skill-Datei

Agentic Jumpstart Dependency Management

Name: Agentic Jumpstart Dependency Management
Author: bearbinary

Dependency management guidelines for Jarvy - crate selection criteria, feature flag best practices, version management, security auditing with cargo-audit and cargo-deny.

bearbinary0 Sterne14.01.2026

Beruf
Kategorien: Automatisierungswerkzeuge

Skill-Inhalt

Dependency Management Guidelines

This skill provides guidance for managing Rust dependencies in the Jarvy project.

Dependency Selection Criteria

Prefer Standard Library First

Before adding external crates, verify stdlib cannot handle the need:

// PREFER: stdlib for simple operations
use std::fs;
use std::path::PathBuf;
use std::process::Command;

// AVOID: Adding crates for trivial functionality

Evaluation Checklist

When considering a new dependency:

Necessity: Can this be implemented in <100 lines?
Maintenance: Is the crate actively maintained?
Transitive deps: How many dependencies does it bring?
: What is the build time impact?

Verwandte Skills

Agentic Jumpstart Dependency Management | Skills Pool

# GOOD: Explicit minimal features
clap = { version = "4.5", features = ["derive"] }
uuid = { version = "1.10", features = ["v7"] }
serde = { version = "1.0", features = ["derive"] }
ureq = { version = "3.1", features = ["json"] }

# BAD: Enabling all features
# clap = { version = "4.5", features = ["full"] }

# v7 provides time-ordered UUIDs for telemetry event ordering
uuid = { version = "1.10", features = ["v7"] }

some-crate = { version = "1.0", default-features = false, features = ["needed"] }

# Standard: Allow patch and minor updates
serde = "1.0"

# Specific: Pin only when necessary
opentelemetry-otlp = "0.31.0"

# Update all dependencies
cargo update

# Update specific dependency
cargo update -p serde

# Check for outdated dependencies
cargo outdated

# Install audit tools
cargo install cargo-audit
cargo install cargo-deny

# Run security advisory check
cargo audit

# Comprehensive check (security, licenses, duplicates)
cargo deny check

[advisories]
vulnerability = "deny"
unmaintained = "warn"
yanked = "deny"

[licenses]
unlicensed = "deny"
allow = ["MIT", "Apache-2.0", "BSD-2-Clause", "BSD-3-Clause", "ISC", "Zlib"]

[bans]
multiple-versions = "warn"
wildcards = "deny"

[sources]
unknown-registry = "deny"
unknown-git = "deny"

## New Dependency: `crate-name`

**Purpose**: [What functionality?]

**Alternatives Considered**:
- stdlib: [Why not sufficient?]

**Metrics**:
- Transitive dependencies: [count]
- Build time impact: [minimal/moderate/significant]
- Last updated: [date]

**Features Enabled**: [list and why]

[build]
rustc-wrapper = "sccache"
jobs = 16

[profile.dev]
opt-level = 1

[profile.release]
lto = "thin"

# Measure build time
cargo build --timings

# Generate HTML report
cargo build --timings=html

[target.'cfg(target_os = "macos")'.dependencies]
macos-crate = "1.0"

[target.'cfg(target_os = "windows")'.dependencies]
windows-crate = "1.0"

cargo check --target x86_64-unknown-linux-gnu
cargo check --target x86_64-apple-darwin
cargo check --target x86_64-pc-windows-msvc

Crate	Version	Purpose
clap	4.5.6	CLI parsing
serde	1.0.204	Serialization
toml	0.9.5	Config parsing
thiserror	2.0.16	Error types
tracing	0.1.40	Logging
ureq	3.1.2	HTTP client
inquire	0.9.1	Interactive prompts
dirs	6.0.0	Platform directories
uuid	1.10.0	Unique IDs
machineid-rs	1.2	Machine fingerprint

Need	Use Existing
JSON	`serde_json`
YAML	`serde_yaml`
TOML	`toml`
Error types	`thiserror`
HTTP	`ureq`
Logging	`tracing`
CLI args	`clap` with derive
Interactive prompts	`inquire`
Unique IDs	`uuid` v7
Platform dirs	`dirs`

Crate	Version	Purpose
tempfile	3.20.0	Temp file handling
assert_cmd	2.0.17	CLI testing

Agentic Jumpstart Dependency Management

Dependency Management Guidelines

Dependency Selection Criteria

Prefer Standard Library First

Evaluation Checklist

Agentic Jumpstart Dependency Management

Dependency Management Guidelines

Dependency Selection Criteria

Prefer Standard Library First

Evaluation Checklist

Reuse Existing Dependencies

Feature Flag Best Practices

Minimize Enabled Features

Document Non-Obvious Features

Disable Default Features When Appropriate

Version Management

Version Specification

Update Commands

Lockfile Management

Security Auditing

Automated Auditing

cargo-deny Configuration

Security Workflow

Adding New Dependencies

Process

PR Template

Build Optimization

Current Build Configuration

Monitor Build Times

Platform-Specific Dependencies

Current Project Dependencies

Runtime Dependencies

Dev Dependencies

Dependency Checklist

Springboot Verification

Coding Agent (bash-first)

Github

Openclaw Parallels Smoke

Fix

Init