Package Manager
The tool that resolves, fetches, and installs dependencies, and pins them for reproducibility.
A package manager resolves a project's declared dependency ranges into concrete versions, fetches them, arranges them on disk, and records the resolution in a Lockfile.
Three responsibilities are worth separating because they fail differently. Resolution — turning ranges into versions, which is where conflicts surface. Fetching — where registry availability and integrity checking matter. Linking — how packages are laid out, which decides what a program can actually import.
The linking strategy is the least visible and most consequential difference between managers. A flat layout hoists everything into one directory, which means a program can import a package it never declared, and that accidental dependency works until it does not. Isolated layouts link only declared dependencies, which prevents that at the cost of more disk work and some tooling incompatibility.
Version managers for the underlying runtime are a related and separate concern, and the ecosystem has churned through several. The practical lesson is that they are cheap to swap and worth keeping current, and that a dead one is a maintenance liability rather than a stable choice.
Ecosystems also have their own gotchas that no gate catches: a configuration key that is valid in one context and unsupported in another is typically ignored rather than rejected. See Silent Failure.
See also13
Monorepo
Several packages developed in one repository with shared tooling and atomic cross-package changes.
Systems & Tooling16 connections
Semantic Versioning
A version-numbering convention where the number communicates the kind of change.
Version Control & Delivery22 connections
Supply Chain Security
Protecting against compromise arriving through the code and tooling a project depends on.
Version Control & Delivery24 connections
Bundler
The tool that resolves an application's modules into the files a browser downloads.
Web Platform18 connections
Dotfiles
A tracked repository of personal configuration, making a machine setup reproducible.
Systems & Tooling17 connections
Secret Management
Storing, distributing, and rotating credentials without embedding them in code or history.
Systems & Tooling33 connections
Module Graph
The directed graph of imports that decides what code ends up where.
Web Platform22 connections
Artifact Repository
The store for the built outputs of software, such as packages, container images, and binaries, so the exact thing that was tested is the exact thing that ships.
Version Control & Delivery9 connections
Archive File
Files that bundle many files and their metadata into one, from tape-era tar streams to zip's index at the end, whose design choices still decide what can be listed, extracted, or exploited.
Systems & Tooling6 connections
Dynamic Linking
Loading a program's libraries at run time from shared files instead of copying them into the executable, which saves space and eases patching at the cost of fragile dependencies.
Systems & Tooling6 connections
Linux Distribution
A complete operating system assembled around the Linux kernel, combining it with system tools, a package manager, and a set of opinions about release cadence, defaults, and freedom, with hundreds in active use.
Systems & Tooling13 connections
GNU Privacy Guard
A free implementation of the OpenPGP standard for encrypting and signing files, email, and software releases, descended from Phil Zimmermann's PGP and known both for its importance to software distribution and for being hard to use.
Systems & Tooling7 connections
Automated Dependency Updates
Bots that open pull requests whenever a dependency releases a new version, how they keep upgrades small and security patches fast, and how they turn into noise or a supply-chain risk when misconfigured.
Version Control & Delivery11 connections
Linked from24
- Archive FileSystems & Tooling
Files that bundle many files and their metadata into one, from tape-era tar streams to zip's index at the end, whose design choices still decide what can be listed, extracted, or exploited.
- Artifact RepositoryVersion Control & Delivery
The store for the built outputs of software, such as packages, container images, and binaries, so the exact thing that was tested is the exact thing that ships.
- Automated Dependency UpdatesVersion Control & Delivery
Bots that open pull requests whenever a dependency releases a new version, how they keep upgrades small and security patches fast, and how they turn into noise or a supply-chain risk when misconfigured.
- BacktrackingComputation & Algorithms
Searching for a solution by making choices one at a time and undoing the latest choice when it leads nowhere, the method behind puzzle solvers, regex engines, and dependency resolvers.
- BundlerWeb Platform
The tool that resolves an application's modules into the files a browser downloads.
- CopyleftVersion Control & Delivery
A licensing strategy that uses copyright to require derivative works to stay open.
- DeprecationMethod
Marking something as superseded and scheduled for removal, without removing it yet.
- Display ServerSystems & Tooling
The program that sits between applications and the screen, keyboard, and mouse, deciding what is drawn where and who receives input. On Linux it is moving from X11 to Wayland.
- DotfilesSystems & Tooling
A tracked repository of personal configuration, making a machine setup reproducible.
- Dynamic LinkingSystems & Tooling
Loading a program's libraries at run time from shared files instead of copying them into the executable, which saves space and eases patching at the cost of fragile dependencies.
- ES ModulesWeb Platform
JavaScript's standard module system of import and export statements, whose static structure enables tree shaking and whose long coexistence with CommonJS caused years of tooling pain.
- FirmwareSystems & Tooling
The software built into hardware itself, running every keyboard, drive, and charger below the operating system, hard to inspect, risky to update, and a favorite hiding place for persistent malware.
- Game ModdingPlay & Games
User modification of a released game, running as its own ecosystem of tools, hosting and legal ambiguity.
- GNU Privacy GuardSystems & Tooling
A free implementation of the OpenPGP standard for encrypting and signing files, email, and software releases, descended from Phil Zimmermann's PGP and known both for its importance to software distribution and for being hard to use.
- Graphics DriverSystems & Tooling
The software that translates a program's drawing commands into instructions a particular graphics card can execute, split between a kernel part that manages memory and displays and a large user-space part that compiles shaders and implements graphics interfaces.
- Linux DistributionSystems & Tooling
A complete operating system assembled around the Linux kernel, combining it with system tools, a package manager, and a set of opinions about release cadence, defaults, and freedom, with hundreds in active use.
- LockfileVersion Control & Delivery
A generated file recording the exact dependency versions an install resolved to.
- MonorepoSystems & Tooling
Several packages developed in one repository with shared tooling and atomic cross-package changes.
- Permissive LicenseVersion Control & Delivery
A license family that imposes little beyond attribution and a warranty disclaimer.
- Rolling ReleaseSystems & Tooling
A distribution model that ships updates continuously instead of in versioned batches, trading stability for currency.
- Semantic VersioningVersion Control & Delivery
A version-numbering convention where the number communicates the kind of change.
- Supply Chain SecurityVersion Control & Delivery
Protecting against compromise arriving through the code and tooling a project depends on.
- Time ZoneSystems & Tooling
Civil time is a political layer over solar time, and its rules change often enough to be data.
- Yak ShavingMethod
A chain of prerequisite tasks that stands between you and the task you meant to do.