Map and Analyze Software Dependencies

This skill maps, analyzes, and visualizes dependencies in software systems, covering build tools, package managers, architectural patterns, and project-management methods for complex interdependencies. It classifies dependencies into six types: direct (immediate requirements/imports), transitive (dependencies of dependencies), circular (mutual dependencies forming cycles), optional (conditional or feature-specific), development (build/test-time only), and runtime (production-execution requirements). Mapping strategy starts from entry points and traces outward, identifies critical-path dependencies, distinguishes compile-time from runtime dependencies, maps both code-level and system-level dependencies, and tracks version constraints and compatibility requirements.

Use it when a codebase's dependency graph needs to be extracted, visualized, or audited for risk - not just installed and forgotten. Automated-discovery commands are given per ecosystem: npm ls --depth=0 / npm ls --all / npx depcheck for Node.js, pipdeptree --graph-output png / pip-licenses --format=json for Python, mvn dependency:tree / mvn dependency:analyze / gradle dependencies for Java, and dotnet list package --include-transitive for .NET.

Manual analysis is shown via a Python AST walker that extracts import/from...import statements per file and builds a project-wide dependency map. Visualization patterns include a D3.js node/link graph and a Mermaid flowchart for service-level architecture, plus a Dependency Structure Matrix (DSM) built as a pandas DataFrame from a module list and their dependency edges. Critical-path analysis includes a function ranking nodes by in-degree (most-depended-on) to surface the top 5 critical dependencies, and a DFS-based cycle detector that returns the actual circular dependency chains found. Build-system integration covers GitHub Actions dependency caching plus generating license and unused-dependency reports, and a multi-stage Dockerfile that separates a production-only dependency-install stage from the full build stage. Risk assessment tracks five health metrics - freshness (age and available updates), security (known vulnerabilities and CVE scores), maintenance (activity level and contributor count), license compatibility, and bundle-size impact - enforceable via a JSON policy schema with per-rule severity, allowed license lists, and staleness thresholds that trigger block/warn/review actions.

Engineering and platform teams who need to understand, visualize, and govern a codebase's dependency graph - including catching circular dependencies and enforcing license/security policy automatically - rather than relying on npm ls output alone. Architectural guidance closes the loop from analysis to prevention: minimize circular dependencies through layered architecture, use dependency inversion for testability and flexibility, apply adapter patterns for external service dependencies, and consider micro-frontend or microservice patterns once a system has grown large enough that its dependency graph is becoming unmanageable as a single unit.