# Dependency Management {#dependency-management}


Managing NPM dependencies, security auditing, and version strategies.


## Package Manager {#package-manager}


Ever Gauzy uses **Yarn Classic (v1)** for dependency management. All lock files use `yarn.lock`.


## Adding Dependencies {#adding-dependencies}


```bash
# Add to a specific package
yarn workspace @gauzy/core add lodash

# Add as dev dependency
yarn workspace @gauzy/core add -D @types/lodash

# Add to root (affects all packages)
yarn add -W some-global-tool
```


## Version Strategies {#version-strategies}


| Strategy    | Notation | Description        |
| ----------- | -------- | ------------------ |
| Exact       | `1.2.3`  | Exact version only |
| Patch range | `~1.2.3` | Allows `1.2.x`     |
| Minor range | `^1.2.3` | Allows `1.x.x`     |

**Recommendation:** Use exact versions (`1.2.3`) for critical dependencies, caret (`^`) for utilities.


## Security Audit {#security-audit}


```bash
# Run security audit
yarn audit

# Fix vulnerabilities
yarn audit fix
```


## Dependency Updates {#dependency-updates}


```bash
# Check for outdated packages
yarn outdated

# Interactive upgrade
npx npm-check-updates -i
```


## Private Registry Packages {#private-registry-packages}


Internal packages from Verdaccio:

```
@ever-co/ui-core
@ever-co/common
@gauzy/contracts
@gauzy/plugin-*
```

See [Private Registry](https://sourcey-gauzy.pages.dev/devops/private-registry/index.md) for configuration.


## Related Pages {#related-pages}


- [Monorepo Navigation](https://sourcey-gauzy.pages.dev/development/monorepo-navigation/index.md) — repo structure
- [Private Registry](https://sourcey-gauzy.pages.dev/devops/private-registry/index.md) — Verdaccio