Dependencies are the third-party libraries (Composer packages, npm packages, system tools) the platform relies on. Managing them well means stability, security and a clean upgrade path.
Where Dependencies Live
- composer.json: PHP runtime libraries.
- package.json: JavaScript front-end libraries.
- System packages: ImageMagick, FFmpeg, Tesseract, Redis etc. — installed via the OS package manager.
- Database extensions: InnoDB, JSON, FTS.
- External services: Stripe, SendGrid, AWS — managed as account credentials.
What to Watch
- Security advisories: CVE-tracked vulnerabilities — patch quickly.
- End-of-life: Major versions reaching EOL — plan migration.
- Abandoned packages: No commits in 2+ years — find replacement.
- License compatibility: GPL/AGPL packages in commercial product may need legal review.
- Major version upgrades: Breaking changes require code adjustment.
Worked Examples
- Security patch: A CVE published for an upstream library; CI flags it; PR with updated version reviewed and merged within hours.
- Major upgrade: PHP 8.2 → 8.4 over the course of a sprint, with feature flags allowing rollback if needed.
- Abandoned package: A used library hasn't been updated in 3 years; fork it or replace with maintained equivalent.
- License audit: Annual review confirms all dependencies are MIT/Apache/BSD — no GPL contamination in the commercial codebase.