dep-checklisted

# dep-check Model memory and blog posts are stale the day they're written; the package registry is the only source of truth for what a dependency's current version is. This skill front-loads a two-minute check that prevents the expensive failure modes: installing a just-published broken release, a prerelease masquerading as current, an abandoned package, or a silent breaking major. Adapter: `.claude/ai-dev-kit.config.json` (`depPolicy`, `ecosystem`, legacy `packageManager`); defaults: 7-day window, judgment-based pinning. ## 1. Query the registry, not the web - Use the adapter's `ecosystem.registryQuery` when set; otherwise the per-ecosystem recipes in [references/registries.md](references/registries.md) (npm-family · PyPI · crates.io · Go · NuGet · Maven · RubyGems · Composer · engine asset stores) — pick the section for the repo's manifest files. - Get three facts: the current stable version, the tag/channel landscape (`latest` can lag or lead; `next`/`beta`/`canary`/pre-releases must never be installed by accident), and the candidate's **publish date**. - One registry query beats any number of web searches for "what's the latest X". ## 2. Apply the release-age window - Prefer the newest version **older than the window** (default ~7 days, adapter `depPolicy.releaseAgeDays`). A just-published release can still be unpublished, yanked, broken, or — worst case — hijacked; a week of ecosystem soak is cheap insurance. - Exception: the newer release contains