# TypeScript dependency management

Generated TypeScript SDKs include dependencies that require ongoing maintenance to ensure security and stability.

## Set up automated dependency scanning

We strongly recommend configuring a dependency scanning tool on your SDK repository. If your organization already uses a scanning tool, configure it for your SDK repository as well. Popular options include [Dependabot](https://docs.github.com/en/code-security/dependabot) (GitHub native), [Snyk](https://snyk.io/), and [Semgrep](https://semgrep.dev/). These tools automatically monitor your dependencies and create pull requests when updates are available.

## Keep dependencies updated

For TypeScript SDKs, lock files like `package-lock.json` freeze dependency versions at SDK generation time. To refresh to the latest secure versions:

```bash
rm -rf package-lock.json && rm -rf node_modules
npm install
```

## Adopt dependency cooldowns

Consider implementing a dependency cooldown strategy where you wait a period (for example, 7-14 days) before adopting newly-published package versions. This practice helps protect against supply chain attacks. Recent incidents have shown that compromised packages are often caught and removed within the first few days of publication. A cooldown period allows the community to vet new releases before they enter your codebase.