How should you handle dependencies and external libraries under code standards?

• A. Use aggressive dependency inclusion with no versioning
• B. Minimize reliance on external libraries and avoid versioning
• C. Use explicit versioning, minimize external dependencies, regularly update, and track licenses and security advisories
• D. Do not track licenses to speed up development

Answer: (C)

Managing dependencies and external libraries is about keeping your project reliable, secure, and compliant. The best approach is to explicitly specify versions, minimize what you depend on, keep everything up to date, and actively track licenses and security advisories.

Explicit versioning and a lock strategy ensure builds are reproducible. When you pin exact versions (or rely on a lockfile), you avoid surprise breaks caused by newer, incompatible releases appearing in your environment. This stability is crucial for testing, deployment, and maintenance.

Minimizing external dependencies reduces the attack surface and the number of things that can go wrong. Each library adds potential bugs, security flaws, and licensing obligations. By judiciously choosing dependencies and removing unnecessary ones, you lower risk and simplify maintenance.

Regularly updating dependencies keeps you protected against known vulnerabilities and bugs. A routine to review and upgrade components—guided by automated tests—helps maintain compatibility while reducing risk over time.

Tracking licenses and security advisories is essential for legal and safety reasons. License tracking ensures you can legally use and distribute the code, especially in combined or commercial projects. Monitoring security advisories lets you respond quickly to vulnerabilities with patches or mitigations.

Examples of practical steps include using a package manager with a lockfile, specifying exact versions, conducting periodic dependency reviews, enabling vulnerability scanning, and maintaining a license and compliance record.