Adding, upgrading, or removing dependencies — justification bar, registry-verified versions, changelog and pinned-constraint archaeology, matching package-manager and lockfile hygiene, one bump at a time, gates after. Use when adding, bumping, removing, or auditing a package; before editing package.json, pyproject.toml, Cargo.toml, go.mod, or any lockfile; on security advisories, audit/Dependabot alerts, deprecation or peer-dependency warnings, version-mismatch errors, or "update everything" requests.
