Zerethon IDE
Sign in

Package managers and dependencies

Beginner 10 min read

Install the libraries a project needs, pin their versions with a lock file and keep them up to date.

Why it matters

Almost every project depends on other people's code. Without a lock file, two machines installing "the same" project get different versions — the most common cause of "it works on my machine" builds.

Where it fits

  1. Plan & Design
  2. Develop
  3. Version control
  4. Verify
  5. ● Build & Package
  6. CI/CD
  7. Deploy
  8. Operate

What you will learn

  • Tell the manifest (what you ask for) from the lock file (what you got).
  • Install exactly the locked versions in CI.
  • Update dependencies deliberately, one change at a time.

Before you start

Manifest and lock file

  • Manifest — package.json, composer.json, pyproject.toml: the packages and the version ranges you accept.
  • Lock file — package-lock.json, composer.lock: the exact versions that were installed. Commit it for applications.
Example 
npm install express      # add a dependency, update both files
npm ci                   # CI and servers: install exactly the lock file
composer install         # PHP: install from composer.lock
python -m pip install -r requirements.txt

Tip: Version ranges like ^4.18.0 follow semantic versioning: the caret accepts new minor and patch versions, not a new major one.

Watch out: Every dependency is code that runs with your permissions. Prefer well-maintained packages, and do not add one for something a few lines of your own code can do.

Official documentation and references

Documentation

Guides

Reference

Learn next

Related topics

Done with this topic?

Reviewed 2026-10-23. Links go to the official documentation unless marked otherwise.