{"post":{"slug":"what-is-a-dependency-2026","title":"What Is a Dependency in 2026: code your project relies on","excerpt":"A dependency is external code your project relies on to work, like a library you install instead of writing yourself. Here is what a dependency is and how to manage it.","category":"code","date":"June 9, 2026","author":"ByteLedger Team","content":"<span class=\"dropcap\">A</span> dependency is external code that your project relies on to function, like a library or package you install rather than writing yourself. If your app uses a tool someone else built to handle dates, send emails, or draw charts, that tool is a dependency: your code depends on it being present and working. Almost every real project has them, often dozens, because reusing trusted code is faster and safer than rebuilding everything from scratch. The trade-off is that each dependency is something you must keep updated, trust, and occasionally untangle, so understanding how they work is part of writing maintainable software.\n\n## How dependencies work\n\nYou rarely copy a library file by hand. Instead, you declare which dependencies your project needs in a manifest file, and a package manager fetches and installs them. In a JavaScript project that file is `package.json` and the manager is npm; in Python it is often a requirements file with pip; other ecosystems have their own equivalents.\n\n```json\n// a package.json snippet declaring two dependencies\n{\n  \"dependencies\": {\n    \"express\": \"^4.19.0\",\n    \"date-fns\": \"^3.6.0\"\n  }\n}\n```\n\nWhen you run the install command, the package manager reads that list, downloads the right versions, and places them where your code can import them. This is why a fresh checkout of a project needs an install step before it will run, and it ties directly into [what a codebase is](/blog/what-is-a-codebase-2026): the dependencies are declared in the codebase but usually not committed line by line.\n\n## Direct vs transitive dependencies\n\nNot every dependency is one you chose.\n\n| Type | What it is |\n|---|---|\n| Direct dependency | A library you explicitly added and use |\n| Transitive dependency | A library your dependencies depend on, pulled in automatically |\n\nYou might add one charting library directly, and it might quietly bring in a dozen smaller packages it needs. Those are transitive dependencies. They matter because a problem in one of them, a bug or a security flaw, affects you even though you never chose it. This is part of why dependency trees can grow surprisingly large.\n\n## Versions and lockfiles\n\nDependencies change over time, and an update can fix bugs or, occasionally, break your code. Version numbers and lockfiles manage this.\n\nA manifest usually specifies an acceptable version range, like accept any 4.x release. A lockfile then records the exact versions actually installed, so that everyone on the team and every server builds with the identical set. That reproducibility is the whole point: it prevents the it-works-on-my-machine problem caused by two people having slightly different versions. Commit your lockfile.\n\n## When to add a dependency, and when not to\n\nA dependency is a convenience and a liability at once. Good ones save you from reinventing hard, well-solved problems like cryptography or date math, where a mistake would be costly. But each one is code you must trust, update, and audit, and it can break or be abandoned. Before adding one, ask whether a few lines of your own would do, how widely used and maintained the library is, and what it drags in transitively. Reaching for a heavy package to avoid writing ten lines is a habit worth breaking. For the wider workflow, [how to use Git and GitHub](/blog/how-to-use-git-and-github-2026) covers how teams track these manifest and lockfile changes safely.\n\n## What to skip\n\n- **Adding a library for a trivial task.** If a few lines do it, write the few lines.\n- **Ignoring the lockfile.** Commit it; without it, builds drift and break unpredictably.\n- **Never updating.** Stale dependencies accumulate bugs and security holes; update on a regular cadence.\n- **Trusting blindly.** Check that a package is maintained and widely used before depending on it.\n\n## FAQ\n\n**What is a dependency in simple terms?**\nExternal code your project needs to work, like a library you install instead of writing that functionality yourself.\n\n**What is a package manager?**\nA tool, such as npm or pip, that installs, versions, and updates your dependencies based on a manifest file you declare them in.\n\n**What is the difference between a direct and a transitive dependency?**\nA direct dependency is one you added on purpose. A transitive dependency is one your dependencies need, pulled in automatically.\n\n**Why should I commit my lockfile?**\nThe lockfile pins exact versions so every machine builds with the same set, which prevents subtle bugs from version drift.\n\n## Where to go next\n\n[What is a codebase](/blog/what-is-a-codebase-2026), [What is a library](/blog/what-is-a-library-2026), and [How to use Git and GitHub](/blog/how-to-use-git-and-github-2026).","hue":240,"metaTitle":"What Is a Dependency in 2026? Plain-English Guide","metaDescription":"What is a dependency in 2026? A clear guide to software dependencies, package managers, direct versus transitive, lockfiles, and when to avoid adding them.","keywords":["what is a dependency 2026","dependency explained","software dependency","dependency for beginners","what does dependency mean","package manager","direct vs transitive dependency","dependency management","lockfile explained","npm pip dependencies"],"tldr":["**A dependency is code you rely on** — an external library or package your project needs to run instead of writing it yourself.","**A package manager handles them** — tools like npm or pip install, version, and update dependencies for you.","**Direct vs transitive matters** — you choose direct dependencies; they drag in their own, which become transitive dependencies.","**Lockfiles pin exact versions** — they record the precise versions used so builds are reproducible across machines.","**Skip:** adding a heavy library for something a few lines of your own code could do; every dependency is a long-term cost."],"readTime":"3 min read","wordCount":751},"related":[{"slug":"what-is-a-package-manager-2026","title":"What is a package manager in 2026? A clear explanation","excerpt":"A package manager installs, updates, and tracks the code libraries your project depends on. This guide explains how it works, what a lockfile does, and how to use one safely.","category":"code","date":"June 1, 2026","author":"ByteLedger Team","readTime":"4 min read","hue":64},{"slug":"what-is-a-library-2026","title":"What Is a Library in Programming in 2026: explained","excerpt":"A library is a reusable collection of prewritten code you pull into your own program to do common jobs, so you call existing functions instead of building everything from scratch.","category":"code","date":"May 13, 2026","author":"ByteLedger Team","readTime":"3 min read","hue":190},{"slug":"what-is-dependency-hell-2026","title":"What Is Dependency Hell in 2026? Causes and Fixes","excerpt":"Dependency hell is what happens when two things your project relies on need different, incompatible versions of the same underlying package. Here is why it still happens in 2026 and how to get out of it.","category":"code","date":"July 22, 2026","author":"ByteLedger Team","readTime":"4 min read","hue":290}],"sameCategory":[{"slug":"bazel-build-explained-2026","title":"Bazel Explained: What Hermetic Builds Actually Cost","excerpt":"Bazel delivers reproducible, precisely cached builds and demands that you describe everything. Here is what you get, what it costs, and who should say no.","category":"code","date":"August 19, 2026","author":"ByteLedger Team","readTime":"3 min read","hue":145},{"slug":"graphql-federation-2026","title":"GraphQL Federation: One Graph, Many Teams","excerpt":"Federation composes independently-owned subgraphs into a single API. Here is what it solves, the operational cost it adds, and when a simpler gateway is enough.","category":"code","date":"August 19, 2026","author":"ByteLedger Team","readTime":"3 min read","hue":300},{"slug":"hermetic-builds-explained-2026","title":"Hermetic Builds Explained: Same Inputs, Same Output","excerpt":"A hermetic build depends only on declared inputs. Here is what that property gives you, the common leaks that break it, and how to move toward it incrementally.","category":"code","date":"August 19, 2026","author":"ByteLedger Team","readTime":"3 min read","hue":130},{"slug":"monorepo-tooling-compared-2026","title":"Monorepo Tooling Compared: What You Actually Need","excerpt":"Monorepo tools solve task orchestration and caching, not repository layout. Here is what each tier provides and how to tell when you have outgrown the simple option.","category":"code","date":"August 19, 2026","author":"ByteLedger Team","readTime":"3 min read","hue":150}],"newer":{"slug":"what-is-a-credit-report-2026","title":"What is a Credit Report in 2026: what is on it and how to read yours","excerpt":"A credit report is the detailed record of how you have borrowed and repaid money. Here is what is on it in 2026, who sees it, and how to check yours.","category":"finance","date":"June 9, 2026","author":"ByteLedger Team","readTime":"3 min read","hue":45},"older":{"slug":"what-is-a-design-pattern-2026","title":"What is a design pattern in 2026? A practical explanation","excerpt":"A design pattern is a reusable, named solution to a recurring software design problem. This guide explains what they are, the main families, and when using one helps versus hurts.","category":"code","date":"June 9, 2026","author":"ByteLedger Team","readTime":"3 min read","hue":268}}