Package Manager

A Package Manager is a tool that installs, updates, and removes the external libraries a project depends on, and resolves the versions of everything those libraries depend on in turn. Without one, developers would copy library files by hand and have no reliable way to reproduce a working environment. The manager reads a manifest listing direct dependencies, resolves the full graph, and writes a lock file that pins exact versions so every machine and CI runner installs the same tree. In JavaScript, npm ships with Node.js, while pnpm and Yarn compete on install speed and disk usage — pnpm links packages from a shared content-addressable store instead of copying them into each project. Python uses pip alongside newer tools such as uv and Poetry, Rust uses Cargo, and Go has modules built into the toolchain. The pitfall is supply-chain risk: a single install can pull in hundreds of transitive packages, and a compromised or abandoned one becomes your problem. Commit the lock file, audit dependencies, and prefer fewer of them. Package managers are distinct from container images, which freeze the whole runtime rather than just the libraries.