# Software dependency

> Code written by someone else that your program needs in order to work.

- Level: Intermediate
- Topics: Software
- URL: https://tidbit.legios.com.ar/software-dependency/
- In Spanish: [Dependencia de software](https://tidbit.legios.com.ar/es/software-dependency/)

A **software dependency** is any outside piece of code your program relies on: a software library for dates, a framework for building web pages, a driver to talk to a database. Instead of writing everything from scratch, developers list the packages they need in a file (`package.json` in JavaScript, `requirements.txt` or `pyproject.toml` in Python, `go.mod` in Go) and a package manager downloads them.

Dependencies have dependencies of their own. Your app might use 20 packages directly, but those pull in others, and those pull in more: these are **transitive dependencies**, and a modern web app often ends up with hundreds or thousands. A **lockfile** records the exact version of every one of them, so the code that runs on a colleague's laptop and on the server is exactly the same.

This saves enormous amounts of work, and it also means trusting a lot of strangers. In 2016 a developer removed a tiny package called `left-pad` and broke builds around the world. In 2021 a flaw in Log4j, a logging library hidden inside countless Java programs, became one of the most serious vulnerabilities in years. In 2024 someone spent two years earning trust in the `xz` project before slipping in a backdoor. Teams now use tools like Dependabot to get alerts and updates, and pin versions using semantic versioning rules.

When versions clash (package A needs version 1 of something, package B needs version 2) developers call it **dependency hell**. Keeping the list short and up to date is part of the job.

## An analogy

A recipe that says "add a jar of store-bought pesto". You save an hour, but now your dish depends on that brand's ingredients, and if they change the recipe or a batch is bad, so is your dinner.

## Keep in mind

- A dependency is outside code your program needs; a package manager installs it.
- Transitive dependencies mean a few direct packages can pull in hundreds more.
- Lockfiles pin exact versions so every machine runs the same code.
- Each dependency is also a security and maintenance risk to keep an eye on.

## Go deeper

- [Dependabot (GitHub Docs)](https://docs.github.com/en/code-security/dependabot)
- [Dependency hell on Wikipedia](https://en.wikipedia.org/wiki/Dependency_hell)

## Related terms

- [Software library](https://tidbit.legios.com.ar/software-library/): Ready-made code for a common task that programmers plug into their own programs.
- [Framework](https://tidbit.legios.com.ar/framework/): A ready-made skeleton for an app: it sets the structure and calls your code.
- [Website](https://tidbit.legios.com.ar/website/): A set of web pages under one address, stored on a server and opened in a browser.
- [Database](https://tidbit.legios.com.ar/database/): An organized store of data that programs can search and update safely.
- [JavaScript](https://tidbit.legios.com.ar/javascript/): The programming language that runs inside web pages and makes them interactive.
- [Python](https://tidbit.legios.com.ar/python/): A popular programming language known for being easy to read and quick to write.
- [Go](https://tidbit.legios.com.ar/go/): A simple, fast programming language from Google, built for servers and cloud tools.
- [Laptop](https://tidbit.legios.com.ar/laptop/): A whole computer folded into one portable case that runs on a battery.