Dependency Management
Managing NPM dependencies, security auditing, and version strategies.
Package Managerโ
Ever Gauzy uses Yarn Classic (v1) for dependency management. All lock files use yarn.lock.
Adding Dependenciesโ
# Add to a specific package
yarn workspace @gauzy/core add lodash
# Add as dev dependency
yarn workspace @gauzy/core add -D @types/lodash
# Add to root (affects all packages)
yarn add -W some-global-tool
Version Strategiesโ
| Strategy | Notation | Description |
|---|---|---|
| Exact | 1.2.3 | Exact version only |
| Patch range | ~1.2.3 | Allows 1.2.x |
| Minor range | ^1.2.3 | Allows 1.x.x |
Recommendation: Use exact versions (1.2.3) for critical dependencies, caret (^) for utilities.
Security Auditโ
# Run security audit
yarn audit
# Fix vulnerabilities
yarn audit fix
Dependency Updatesโ
# Check for outdated packages
yarn outdated
# Interactive upgrade
npx npm-check-updates -i
Private Registry Packagesโ
Internal packages from Verdaccio:
@ever-co/ui-core
@ever-co/common
@gauzy/contracts
@gauzy/plugin-*
See Private Registry for configuration.
Related Pagesโ
- Monorepo Navigation โ repo structure
- Private Registry โ Verdaccio