Dependency
- Industry term
A dependency is outside software your project relies on, usually added as a named package, so you can reuse a feature someone else wrote instead of building it yourself.
Your project keeps a list of the packages it needs, with a version for each. An install tool reads that list and downloads each package, along with the packages each one needs in turn, so one addition may bring dozens. From then on, their authors' updates and security fixes are part of your app's upkeep.
Where you’ll meet it
You ask your coding agent to make your workout tracker say "3 days ago" in place of a raw date. It adds a package you've never heard of, reports that it installed without errors, and goes on to the next task.
What to do
Ask the agent why it chose that package and whether the app needs one, since a few lines of code often format dates. If it stays, look it up on the package site (npm for JavaScript, PyPI for Python) and check the exact name, the license, and the last update.
Easy to mix up
| Dependency | API |
|---|---|
| Inside your app, installed along with it | On another company's computers, reached by sending requests |
Check yourself
Your app has run for a year with nobody touching its code or reinstalling anything. A security scan now flags three of its packages. Where did the new problems come from?
Go deeperLockfiles pin exact versions, and packages are a route for attacks
The project's list, the manifest, usually allows a range of versions for each package. A lockfile records the exact version of every package that was installed, and keeping it in the project lets every computer install the same set. Two installs can still differ, since some packages download a separate build for each operating system, and a different version of the language running the app, such as Node or Python, can change what installs.
Some packages run a script while they install, with the access of whoever runs the install, and all package code later runs inside your app, with the app's access. Attackers register look-alike names or take over popular packages. In 2018 the npm package event-stream passed to a new maintainer, who added a dependency built to steal from a bitcoin wallet app. Code models sometimes invent package names, which attackers can then register.