Check your dependencies

Run the deps gate, read what it found, set a licence and advisory policy in main.yaml, and keep CI honest when the network is down.

Building for 0.5

Status Status is where the work is: Planned (in a milestone, not started), Building (tickets in progress), Preview (usable, may change), then the stability it ships at.

Stability The promise an interface ships with.

Stable Follows semantic versioning; breaking changes need a new major, 12 months of overlap and a codemod.
Beta Usable in production; may change before it becomes stable.
Experimental May change or go away; needs an explicit opt-in in main.yaml.

Stability levels

View as Markdown Open in Claude Edit

Updated 2026-10-28

You will run the dependency checks on your app, read a finding, set a policy and ignore one advisory with an expiry. It takes about 10 minutes.

You need

A MainSDK app with a main.yaml, a lockfile (pnpm, npm, yarn or bun) and its packages installed.

1. Run the check

bash

npx mainsdk check

The first run asks the registry and OSV.dev and keeps the answers for 24 hours. Findings under deps name the package, the version, why and the fix.

2. Read a finding

text

MAIN-DEPS-0001  high  package.json:12
react-query-hooks-pro is not on its registry; a model may have made the name up, and anyone can register it
fix: Remove it or replace it with the package you meant; react-query-hooks-pro does not exist on its registry

A name that doesn't exist, one first published days ago (MAIN-DEPS-0002) and one a letter from a popular package (MAIN-DEPS-0003) are the signs of a name an agent made up or got wrong.

3. Set your policy

main.yaml

deps:
  licences:
    allow: [MIT, Apache-2.0, ISC, BSD-3-Clause]
  advisories:
    fail-on: high
  scripts:
    allow: [esbuild, sharp]

An advisory below fail-on is a warning. A package that runs an install script and isn't allowed is a warning too (MAIN-DEPS-0006).

4. Ignore an advisory for a while

main.yaml

deps:
  advisories:
    ignore:
      - { id: GHSA-xxxx-xxxx-xxxx, until: 2027-01-31, reason: "Not reachable: only used in tests" }

Every entry needs an id, a future until and a reason. After until the advisory is reported again, with MAIN-DEPS-0008.

5. Run it in CI

CI has the network, so make a missing answer a failure:

main.yaml

deps:
  offline: fail

On a laptop with no network, mainsdk check reports MAIN-DEPS-0007 as info and still checks licences and install scripts.

Check it worked

Add a dependency that doesn't exist to package.json and run npx mainsdk check --json; it exits 1 with MAIN-DEPS-0001. Remove it and the exit is 0 again. See Dependency checks.

Was this page helpful?