Package & Dependency Management

Fall 2025

1

Please Help

• High School Students visiting this Saturday from 9:30-11:00AM!
• PLEASE HELP ME!!!!!!!!

Outline

1. More on Docker
2. Discussion of Readings
3. Exploration of different package managers
4. More time for Lab 4

3

Outline

1. More on Docker
2. Discussion of Readings
3. Exploration of different package managers
4. More time for Lab 4

4

What did you think of Docker?

Images, Containers, and Volumes

• What is an Image?
• What is a Container?
• What is a Volume?
• What is a Bind Mount?
• What is the purpose of a Dockerfile?
• What is the purpose of a docker-compose.yml file?

Docker: Cool Stuff

With Docker, you can install containerized versions of new libraries, languages, etc. without having to worry about software incompatibilities with your existing OS / software libraries.

• With Docker, just run whichever version of your language in a container…and then delete the container when you’re done with it!

Docker Experiments

​

Please try the following (make sure that Docker is running):

docker run -it python:2.7

docker run -it python:latest

docker run -it node:latest

​

What happened?

• How did Docker know how to run these containers?
• https://hub.docker.com/search?image_filter=official
• What do the -i and -t flags do?
• -i interactive
• -t interact with the terminal shell

8

Docker Experiments

​

Try running some local files with various versions of Python and Node:

• Make a directory in the root of your csci338 folder called lecture06. Inside of lecture06, create two files: hello.py and hello.js

hello.py

def main():

print("hello world")

​

if __name__ == "__main__":

main()

hello.js

console.log("hello world!")

9

Docker Experiments

​

docker run python:latest python hello.py

docker run node:latest node hello.js

​

Amazing!! Now delete all of the containers you just made. You could do this via the Docker UI, but try doing it via the command line

10

What if you wanted to try out Rust?

• Download, build, and run the Rust container: �docker run -it rust:latest bash
• Install vim:�apt update && apt install vim
• Create a hello.rs file on the Docker container using vim: (https://doc.rust-lang.org/rust-by-example/hello.html)
• Compile it: rustc hello.rs
• Run it: ./hello

Outline

1. More on Docker
2. Discussion of Readings
3. Exploration of different package managers
4. More time for Lab 4

12

What do we mean by Dependency Management?

• What is a dependency?
• Someone else’s code that you rely on for your code to work. So that you don’t have to reinvent the wheel every time you do something.
• ​
• Why are they so hard to manage?
• You open up your code to “chain reactions”
• Less control
• ​

13

What happened in the LeftPad Debacle?

• Scene 1: left pad used by the entire internet but only 10 lines of code (trivial)
• Scene 2: Programmer and company have argument over copyright.
• Open Source v. Copyrighted version
• Scene 3: Corporation wins
• Scene 4: Node.js creates some new protections so that this doesn’t happen again

What happened in the Everything Debacle?

• See notes below

​

What are the trade-offs associated with relying on dependencies?

​

What are dependencies good?

• You can use code that someone else wrote that’s good.
• Reduces the complexity of your code
• Can rely on other ppl to keep things current and updated

​

What are the downsides?:

• See previous slides
• Deprecation – package no longer maintained.

16

What should you consider before adding a new dependency to your software project?

​

• Budget – some dependencies have +/- efficiencies for the task
• How well it’s maintained.
• Company reputation
1. Has it stood the test of time?
• Update schedule
• Big changes happening (new features versus minor edit).
• # of downloads, # size of the team
• Look at the forum – are people’s questions getting answered (nicely)

17

Stuff that can go wrong…

​

• If “DepA” was introduced, and now lots of people at your organization rely on DepA, who should maintain it?
• What if one of the dependencies that DepA relies on – DepB – has a security vulnerability. DepB now requires that you upgrade to a newer version, but DepA relies on the previous version of the dependency. What do you do?

18

Some dependencies we will be using…

This week: Python & JavaScript dependencies – how do we manage those!? Examples:

1. Database connection helpers
2. Packages for simplifying HTTP requests
3. Web server packages
4. REST API packages
5. Authentication
6. Widgets for building UIs

19

Layers of Dependencies

​

Systems dependency managers manage programs for a single host machine.

What are some examples of systems dependency managers?

• OS: brew. Linux: apt, dnf, yum. Window: winget, chocolatey
• Python: pip, poetry
• Node: npm, yarn, npmpm

20

Outline

1. More on Docker
2. Discussion of Readings
3. Exploration of different package managers
4. More time for Lab 4

21

Why might we need more fine-grained dependency management tools?

​

As a programmer who writes software, a global, system-level dependency management tool might not be enough! Why?

• Multiple software projects may rely on multiple versions of the same language or framework
• Different versions lead to different behaviors
• Different language features / environments move at different time scales, so system-level packages can be old
• Your OS package manager could install an older version of the tool you need

22

JavaScript Dependency Management

Make sure Node.js is installed…

• ex: npm is for front-end development (also yarn)

$ npm init

$ npm install react react-dom

$ npm install prettier --save-dev

​

• npm manages package.json and package-lock.json
• Dependencies are stored in the node_modules directory at the root of the project
• Exclude node_modules from version control. Why?

Python Dependency Management

• pip is a package manager used to install system-level python packages.
• However (important): you can create “virtual environments” (venv) – additional python installations that don’t conflict with your systems-level Python installation(s).
• To manage these virtual environments, wrappers around pip and venv are now used

Python Dependency Management: Poetry

• In this class, we will be using a tool called Poetry to manage python virtual environments
• Poetry manages pyproject.toml and poetry.lock files

$ pip install poetry

$ poetry init

$ poetry search request

$ poetry add request

$ poetry install

$ poetry run [whatever]

Common Features of a Good Package Manager

Poetry and NPM provide:

• A Nice CLI (command-line interface)
• Text-file dependency tracking (for version control) – usually declarative
• Reproducibility

​

Lab 5: Practice Using Package Managers

​

On Thursday, you will be doing a lab to explore some dependencies using three different package managers:

1. Apt / brew
2. Poetry
3. NPM

​

See you Thursday!

27

Outline

1. More on Docker
2. Discussion of Readings
3. Exploration of different package managers
4. More time for Lab 4

28

Keep working on Lab 4