Dependency

A dependency is any piece of code or service your project relies on but did not write itself, such as a library, a framework or a database driver. Direct dependencies are the ones you list; transitive dependencies are those your dependencies need in turn.

Why it matters

Dependencies save huge amounts of work, but each one adds risk: security flaws, breaking changes, abandoned projects and license obligations. A typical web project can pull in hundreds of transitive packages. Keeping them updated and locked to known versions is a routine part of maintenance.

Example

{
  "dependencies": {
    "express": "^4.19.2"
  }
}

Installing express also installs the packages it needs, recorded in a lock file such as package-lock.json so every machine gets identical versions.

Common mistakes

• Never updating, which leaves known vulnerabilities in place.
• Adding a large package for one tiny helper function.
• Not committing the lock file, so builds differ between machines and fail unexpectedly.

Related

• Package manager
• Semantic versioning
• Software license
• Library vs framework

This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.