Developer Tools · Cluster
Package Managers
Resolution algorithms and lockfiles.
- 01 Version Ranges as Sets of Versions How a constraint such as ^1.2.3 becomes an explicit set of admissible versions, how two constraints intersect, and why prerelease rules stop that set from being an interval.
- 02 Building the Dependency Graph from Manifests Why a manifest describes requirements rather than edges, how node identity is decided, which dependency kinds the walk follows, and why the graph only exists after versions are chosen.
- 03 What a Lockfile Records and What It Leaves Out How a lockfile turns one resolution result into an artifact the installer can consume without a solver, which facts it must store, and how an install checks that it still matches the manifest.
- 04 Conflict-Driven Backtracking in Dependency Resolution How a resolver learns from failure instead of retrying every combination, using incompatibilities, unit propagation, and backjumping to the decision that actually caused the conflict.
- 05 Diamond Dependencies and Duplicate Versions What happens when two packages require incompatible versions of a third, why some installers keep both copies, and what duplication costs in type identity, disk space, and patch coverage.
- 06 Minimal Version Selection and Its Compatibility Assumption How Go chooses the maximum of declared minimum versions, why that rule needs no backtracking, and what an ecosystem gives up when its requirement language has no upper bounds.
- 07 Dependency Resolution as a Satisfiability Problem How version selection encodes into boolean clauses, why the decision problem is NP-complete, and what that bound predicts about real installs and about optimisation criteria.
- 08 Lockfile Determinism, Diffs, and Merge Conflicts Why two resolutions of the same inputs should produce identical bytes, which writer choices break that, and why merging lockfiles textually is unsound even when it usually appears to work.
- 09 Integrity Hashes and Registry Trust What a package digest actually covers, where it is recorded, and which attacks a lockfile digest stops and which it cannot, from republishing to dependency confusion.
- 10 Peer, Optional, and Override Constraints in Resolution Three mechanisms that break the assumption that manifests fully determine the graph: peer requirements scoped to an ancestor, optional edges with three outcomes, and overrides that rewrite the input.