Package Managers and Lockfiles

Installing a library takes one command. Keeping a project's dependencies reproducible and safe takes a little more care.

What a package manager does

A package manager installs, upgrades, configures and removes software in a consistent way. Language ecosystems each have their own, and operating systems have theirs.

Why lockfiles matter

A manifest says which versions are acceptable; a lockfile records exactly which versions were installed. Committing the lockfile means everyone, including your build server, gets the same dependency tree.

Dependency hygiene

• Add dependencies deliberately; each one is code you now depend on.
• Check that a package's name is exactly right. Look-alike names are a known attack route.
• Update regularly in small steps rather than rarely in large ones.
• Use your ecosystem's audit tooling to flag known vulnerabilities.

Watch install scripts

Some ecosystems allow packages to run scripts during installation. Know whether yours does, and what it is allowed to do.

last updated 2026-10-20