dependency

Applications rarely consist entirely of custom code. Developers often use existing librariesGlossary · In brieflibraryA library is a collection of reusable software code for a defined task. An application can call that code to use existing functionality.Read more, frameworksGlossary · In briefframeworkA framework is a coherent foundation for software development, providing reusable code, a defined structure and conventions for building an application.Read more and packages for tasks such as authenticationGlossary · In briefauthenticationAuthentication is the process by which a system verifies the claimed identity of a user, device or application.Read more, data processing or sending email. If the application needs a component to build or run, that component is a dependency.

Direct and indirect dependencies

A direct dependency is deliberately added to a project. It may itself need other packages, known as indirect or transitive dependencies. Adding one package can therefore bring in a whole chain of dependencies.

A package manager tracks the dependencies a project uses and retrieves the appropriate versions. A lockfile often records the exact versions as well. This ensures developers, test environments and production servers use the same combination of packages.

Why dependencies need maintenance

A dependency can save development time, but is often maintained outside the project. A new version may fix bugs, close security vulnerabilities or introduce changes that are incompatible with the application. Teams therefore review available updates and test whether the software still works after installing them.

Not every update needs to be installed immediately. It is useful, however, to know which parts of the application rely on a dependency and how actively the package is maintained. A dependency that no longer receives updates can eventually become a security or maintenance risk. The team can then switch packages, implement the required function itself or limit its use.