Dependencies, Licences and the Supply Chain
Most of a shipped program was written by strangers. Pulling in a library brings its bugs, its updates and its licence terms, so a team has to know what it depends on, what those terms allow, and what happens when a dependency stops being maintained.
What a learner can do afterwards
- Read a dependency tree and find a package nobody chose directly
- Say what a copyleft licence asks of a project that links against it
- Plan what a team does when a dependency is abandoned
1 · Read
Most of a shipped program was written by strangers. You choose a few libraries, and each one quietly brings its own helpers. The full list is your dependency tree, and it runs much longer than the list you picked.
You add one chart library to your project. The tree shows it pulled in three more packages, including a date helper you never chose. That helper is a transitive dependency: yours through someone else.
Every package ships with licence terms. Permissive terms ask only for credit, but a copyleft licence asks more. If you ship a project built on copyleft code, you must share your own changes under the same terms.
Plan for the day a maintainer walks away. Pin your versions, watch for stalled updates, and know which dependency you would replace first.
Know your full tree, respect each licence, and keep a plan for the dependency that goes quiet.
2 · Watch
Take it off screen
Where it sits
Learn first
This opens up
Nothing builds on it yet.
8 questions wait behind this lesson, each with its answer explained. Every answer feeds the sky: stars light as they are learned, and dim when it is time to come back.