Software dependency
Code written by someone else that your program needs in order to work.
A software dependency is any outside piece of code your program relies on: a software library for dates, a framework for building web pages, a driver to talk to a database. Instead of writing everything from scratch, developers list the packages they need in a file (package.json in JavaScript, requirements.txt or pyproject.toml in Python, go.mod in Go) and a package manager downloads them.
Dependencies have dependencies of their own. Your app might use 20 packages directly, but those pull in others, and those pull in more: these are transitive dependencies, and a modern web app often ends up with hundreds or thousands. A lockfile records the exact version of every one of them, so the code that runs on a colleague's laptop and on the server is exactly the same.
This saves enormous amounts of work, and it also means trusting a lot of strangers. In 2016 a developer removed a tiny package called left-pad and broke builds around the world. In 2021 a flaw in Log4j, a logging library hidden inside countless Java programs, became one of the most serious vulnerabilities in years. In 2024 someone spent two years earning trust in the xz project before slipping in a backdoor. Teams now use tools like Dependabot to get alerts and updates, and pin versions using semantic versioning rules.
When versions clash (package A needs version 1 of something, package B needs version 2) developers call it dependency hell. Keeping the list short and up to date is part of the job.
Keep in mind
- A dependency is outside code your program needs; a package manager installs it.
- Transitive dependencies mean a few direct packages can pull in hundreds more.
- Lockfiles pin exact versions so every machine runs the same code.
- Each dependency is also a security and maintenance risk to keep an eye on.
