Adding a Dependency
This playbook guides SDK maintainers through the process of adding a new dependency to an SDK repository. It covers justification requirements, health and security evaluation, approval workflows, and integration steps. By following these steps, teams ensure that dependencies are vetted for maintenance health, security posture, license compatibility, and performance impact before integration.
Related resources:
- Dependency Management Standard — dependency requirements and audit practices
- SDK Size and Performance Budgets — size and performance tracking requirements
- Security Practices — security requirements for dependencies
Before writing any code, you MUST create an issue that describes what the dependency does and why the functionality cannot be built in-house or is not already covered by an existing dependency.
The issue MUST include documentation of the following:
- Maintenance health (last release date, number of maintainers, open issue count)
- Security posture (known vulnerabilities, audit history)
- License compatibility
- Size impact on the SDK (see SDK size and performance budgets)
You MUST receive explicit approval from the team lead in the issue before writing any code.
When submitting the pull request, you MUST:
- Pin to a version range (not floating
latest) - Add to dependency audit tracking
- Note the size/performance impact in the PR description
You SHOULD use the sentry-skills:security-review skill to evaluate security implications of the new dependency.
The PR reviewer MUST explicitly acknowledge the new dependency, not just approve the PR overall. The review comment MUST confirm that the dependency was evaluated.
- Dependency Management — requirements for adding and maintaining dependencies
- SDK Size and Performance Budgets — size and performance budget tracking
- Security Practices — security requirements and vulnerability handling
| Version | Date | Summary |
|---|---|---|
1.0.0 | 2026-02-20 | Initial Adding a Dependency playbook |
Our documentation is open source and available on GitHub. Your contributions are welcome, whether fixing a typo (drat!) or suggesting an update ("yeah, this would be better").