Software Engineering · Cluster
Dependencies
Selection, upgrades, and supply risk.
- 01 What a Version Range Selects: The Interval Algebra Behind Caret and Tilde How comparators, disjunction, and prerelease exclusion turn a version constraint into a concrete set of versions, and where the range language stops describing compatibility at all.
- 02 Resolution as Constraint Search: Why Dependency Solving Is NP-Hard How a resolver chooses versions for a whole graph at once, why the general problem resists polynomial algorithms, and which practical strategies keep real graphs solvable.
- 03 Lockfiles: Recording the Resolved Graph Without Re-Resolving It What a lockfile stores beyond version numbers, how it stays consistent with the manifest, and why regeneration is a different operation from installation.
- 04 When One Graph Contains Several Copies of the Same Package How flat installation trees force duplicate versions into a single directory, what breaks when two copies coexist, and how hoisting decides which copy a require call finds.
- 05 Install Scripts: The Code That Runs Before the Package Does What package managers execute at install time, why lifecycle hooks exist, and how their privilege, ordering, and failure semantics make them a separate trust boundary from the code being installed.
- 06 How a Package Name Becomes a Download: Registry Lookup Order and Confusion The chain from a bare name in a manifest to a fetched artifact, how registries and scoped namespaces are consulted in order, and why that order is exploitable.
- 07 Peer Requirements and the Problem of Straddling Two Majors Why some dependencies must be singletons supplied by the consumer, what happens when a package is asked to support two incompatible majors at once, and how the constraint is expressed.
- 08 Yanking, Deprecation, and Retraction: Withdrawing a Version After Publication The three distinct ways a publisher can withdraw a release, what each does to existing lockfiles and fresh resolutions, and why immutability is the property they all trade against.
- 09 Signed Repository Metadata and the Compromise-Resistant Update Protocol Why a signature on the artifact is not enough, how role-based metadata separates signing keys by function, and what the freshness and freeze defences cost in round trips.
- 10 Advisory Ranges, Reachability, and Deciding a Vulnerability Does Not Matter How advisory databases express which versions are affected, why a version range in an advisory is not the same claim as an exploitable dependency, and what evidence supports suppressing a finding.