Curated package selections grouped by purpose, with alternatives and usage guidance.
A curated list of packages grouped by purpose. Each entry reflects real project experience — packages that have proven reliable, well-maintained, and composable. This is a starting point, not a mandate.
Pin major versions. Use ^ (caret) ranges in package.json to allow patch and minor updates while preventing breaking changes. Run pnpm outdated monthly.
Update regularly. Apply minor/patch updates in a dedicated PR with a passing CI build.
Audit before adding. Before adding a new dependency, check: Is there already a package in the repo that does this? Is the package actively maintained? What is the bundle size impact?
Lock files are sacred. Always commit pnpm-lock.yaml (or equivalent). Never delete it to "fix" install issues — investigate the root cause.
Duplicate functionality. Two packages solving the same problem (e.g., both axios and fetch wrappers).
Abandoned packages. Dependencies with no updates in 12+ months and open security advisories.
Kitchen-sink imports. Importing an entire utility library for one function. Prefer tree-shakeable packages or copy the single function.
Transitive dependency reliance. Using a package that is only available because another package depends on it. Always add explicit dependencies for packages you import directly.