Dependency
Noun · Open Source
Definitions
Dependency in software development is any external package, library, framework, or service that a project requires to function. When your application uses a database driver, HTTP client, or logging framework, each one is a dependency. Dependencies are managed through package managers (npm, pip, Cargo, Maven) that resolve version requirements and download the correct packages. Direct dependencies are those your project explicitly requires, while transitive dependencies are pulled in by your direct dependencies. Dependency management is one of the most challenging aspects of software maintenance: version conflicts (dependency hell) occur when two packages require incompatible versions of a shared dependency. Security vulnerabilities in dependencies can expose your application (as seen in the Log4Shell incident). Lock files ensure everyone builds with identical dependency versions. Tools like Dependabot and Renovate automate dependency updates. The principle of minimal dependencies encourages using only what is truly needed, as each dependency adds supply chain risk, build complexity, and potential breaking changes.
In plain English: Code written by someone else that your project needs to work — like ingredients in a recipe that you buy rather than grow yourself.
Transitive dependencies — the dependencies of your dependencies — are where the real risk lurks. The left-pad incident (2016) showed how removing a single 11-line npm package could break thousands of builds worldwide. Supply chain security starts with knowing your full dependency tree.
Example: 'Our package.json has 15 direct dependencies. npm ls --all shows 1,847 transitive dependencies. We have no idea what most of them do.'
Source: transitive risk / left-pad