Checklist-driven review for evaluating system packages and npm dependencies before adoption.
Use this skill when evaluating a new package (system package, npm, or other) for adoption into the Bloom project.
Ensure every dependency meets freshness, security, maintenance, and size standards before it enters the project. Follow the principle: system tools via Containerfile (dnf install) or container images, application dependencies via npm.
Before adopting any dependency, determine the right source:
# Add to Containerfile: RUN dnf install -y <package>
podman search <image> # for containerized services
npm view <package> version
npm view <package> time.modified
bootc status # check current image
npm view <package> time.modified
gray-matter (last published 2019) is an example of a banned dependency.npm audit and review findings.
npm audit
bootc upgrade --check
npm pack --dry-run <package> 2>&1 | tail -1 # check package size
npm view <package> license
After completing the checklist, issue one of:
Produce a structured review:
Package: <name>
Source: <containerfile | container | npm | other>
Version: <version evaluated>
1. Source: [appropriate | review — reason]
2. Freshness: [pass | warn — last published <date> | fail]
3. Security: [pass | fail — <CVE details>]
4. Maintenance: [pass | warn | fail]
5. Dep Footprint: [pass | warn — <size/count> | fail]
6. License: [pass | review — <license>]
Verdict: [approve | conditional-approve | reject]
Conditions: <if applicable>