manage

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

Manage Dependencies

管理依赖项

Add, remove, update, install, or vendor dependencies. git-pkgs detects the package manager from lockfiles and runs the appropriate command.

添加、移除、更新、安装或本地化依赖项。git-pkgs 会从锁文件中检测包管理器并运行相应的命令。

Commands

命令

Add a dependency:

bash

git-pkgs add lodash
git-pkgs add lodash --dev

Remove a dependency:

bash

git-pkgs remove lodash

Update dependencies:

bash

git-pkgs update           # update all
git-pkgs update lodash    # update one package

Install from lockfile:

bash

git-pkgs install

Vendor dependencies into the project:

bash

git-pkgs vendor

添加依赖项：

bash

git-pkgs add lodash
git-pkgs add lodash --dev

移除依赖项：

bash

git-pkgs remove lodash

更新依赖项：

bash

git-pkgs update           # update all
git-pkgs update lodash    # update one package

从锁文件安装：

bash

git-pkgs install

将依赖项纳入项目本地存储：

bash

git-pkgs vendor

Before adding a dependency

添加依赖项之前

Check in order:

Standard library - does the language already provide this?
Transitive cost - how many dependencies does it bring? Check with
```
git-pkgs tree
```
after adding.
Smaller alternative - is there a focused package that does just what's needed?
Inline it - can you write 20-50 lines instead of adding a dependency?

Always clarify if a dependency is for development only (

--dev

) to minimize the production attack surface.

按以下顺序检查：

标准库 - 该语言是否已提供此功能？
传递依赖成本 - 它会引入多少依赖项？添加后使用
```
git-pkgs tree
```
查看。
更轻量的替代方案 - 是否有仅满足所需功能的专注型包？
自行实现 - 能否编写20-50行代码来替代添加依赖项？

始终明确依赖项是否仅用于开发环境（

--dev

），以最小化生产环境的攻击面。

After modifying dependencies

修改依赖项之后

Run
```
git-pkgs reindex
```
to update the database
Run
```
git-pkgs vulns scan
```
to check for new vulnerabilities
Run tests to verify nothing broke
Commit the lockfile changes

运行
```
git-pkgs reindex
```
以更新数据库
运行
```
git-pkgs vulns scan
```
以检查新的漏洞
运行测试以验证没有功能损坏
提交锁文件的更改

When to use

适用场景

When the user asks to add, remove, or update a package
When installing dependencies in a freshly cloned repo
When vendoring for airgapped or reproducible builds

当用户要求添加、移除或更新包时
当在刚克隆的仓库中安装依赖项时
当为离线环境或可复现构建进行依赖项本地化时