npx skills add ...
npx skills add bitwarden/ai-plugins --skill reviewing-dependency-changes
npx skills add bitwarden/ai-plugins --skill reviewing-dependency-changes
Use this skill when a PR diff contains changes to dependency manifest files (package.json, .csproj, Cargo.toml, go.mod, requirements.txt, etc.) or when reviewing Renovate/Dependabot bot PRs. Evaluates new dependencies for AppSec approval process compliance, major version bump significance, lock file hygiene, and dependency removal completeness. Does NOT perform deep security or license analysis — that is handled by the bitwarden-security-engineer plugin's reviewing-dependencies skill.
Flag this skill when any of these files appear in the diff:
package.json, package-lock.json*.csproj, Directory.Packages.props, packages.lock.jsonCargo.toml, Cargo.lockgo.mod, go.sumrequirements.txt, pyproject.toml, poetry.lockGemfile, Gemfile.lockWhen a PR adds a dependency that was not previously in the codebase, Bitwarden's Dependency Review and Approval process requires AppSec review and approval before integration. This applies to all new dependencies — production, dev, and test.
The submitter must provide the package name/version, ecosystem, justification, scope, affected products, and what it replaces. A security engineer creates a VULN task in Jira and evaluates the dependency across security (known CVEs, exploitability), license compatibility (permissive licenses like MIT/Apache-2.0 are acceptable; copyleft licenses like GPL/AGPL are flagged), maintenance health (active maintainers, recent releases, security policy), supply chain risk (typosquatting, ownership changes, obfuscated install scripts), and transitive dependencies before rendering an approval decision.
Evidence that the dependency approval process was followed:
VULN-1234)When emitting a finding that references the Dependency Review and Approval process, always link the process name to https://bitwarden.atlassian.net/wiki/spaces/APPSEC/pages/2774466657/Dependency+Review+and+Approval so the posted review comment points reviewers to the canonical documentation.
<package> added. Bitwarden requires AppSec approval before introducing new dependencies. The submitter should reach out to the AppSec team to initiate the Dependency Review and Approval process.<package> dependency?A major version bump (e.g., v2 → v3) may introduce breaking changes that affect Bitwarden's codebase.
<package> from vX to vY (major). Were breaking changes evaluated?<package> is being downgraded from vX to vY. This is unusual and may reintroduce resolved vulnerabilities.Lock files ensure reproducible builds. Inconsistencies between manifests and lock files are a build reliability and security concern.
| Scenario | Finding |
|---|---|
| Manifest changed, lock file not updated | ⚠️ IMPORTANT: Lock file not updated to reflect manifest changes |
| Lock file changed, no manifest change | ❓ QUESTION: Lock file changed without a corresponding manifest change — was this intentional (e.g., npm audit fix)? |
| Lock file deleted | ⚠️ IMPORTANT: Lock file removal breaks reproducible builds |
Renovate and Dependabot PRs are part of Bitwarden's Stage 5 (Monitoring) process. These automated updates to existing approved dependencies require different review treatment.
renovate[bot], dependabot[bot], or similar bot accounts| Scenario | Action |
|---|---|
| Minor/patch update to existing dependency | No approval-process finding needed. Focus on lock file hygiene and CI status. |
| Major version bump from bot | Flag per Area 2 — major bumps warrant human review regardless of source. |
| Bot PR introduces a net-new dependency | Flag per Area 1 — new dependencies require the approval process regardless of source. |
When a dependency is removed from a manifest, verify the removal is complete.
import ... from '<package>', require('<package>')using <namespace>, references in other .csproj filesuse <crate>::, extern crate <crate>import <package>, from <package> importDockerfile, docker-compose.yml.github/workflows/*.yml)Makefile, task runners<package> removed from manifest but still referenced in code.