meson-subprojects-management — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited meson-subprojects-management (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Use subprojects when a dependency is not available on the system, or when the project deliberately vendors a known-good copy.
Runnable examples live under this skill's examples/ directory.
Prefer a system dependency when possible.
Vendor only when one of these is true:
zlib_dep = dependency('zlib', fallback: ['zlib', 'zlib_dep'])That is the standard pattern: prefer the system dependency first, then fall back to the subproject if needed.
A subproject should export a dependency object, not just a built library.
# inside the subproject
mylib_dep = declare_dependency(
include_directories: inc,
link_with: mylib,
)Then the parent project consumes one object instead of rebuilding its dependency graph by hand.
meson wrap install <name> to fetch a wrap definitionmeson subprojects download to fetch sourcesmeson subprojects update to refresh themmeson subprojects purge --confirm --include-cache to clean stale wrap artifactsCache wrap downloads, not the whole build tree, unless you have a narrow and well-tested reason to restore the build tree itself. The safe general cache targets are:
subprojects/packagecachesubprojects/ at the top levelauto_dep = dependency('foo', required: false)
if not auto_dep.found()
foo_proj = subproject('foo')
auto_dep = foo_proj.get_variable('foo_dep')
endifDo not vendor a dependency just because it is convenient today.
Avoid vendoring when:
subproject() from deep inside nested build logicmeson-build-systemmeson-ci-cd-integrationmeson-advanced-project-designmeson-package-export-distributionSubprojects inherit language defaults from the parent project's default_options only when they do not set their own. If a subproject explicitly sets c_std or cpp_std in its own project() defaults, those values win for that subproject's targets.
When vendoring an existing library as a subproject, preserve the upstream standard choice so the imported code behaves the same way it did before vendoring:
# Vendored upstream subproject
project('mylib', 'c', default_options: ['c_std=c11'])For a new subproject that you control, prefer the same standards as the parent project unless a target-specific reason requires a different baseline.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.