Top 30 Dependencies Interview Questions and Answers
30 multiple-choice questions on Dependencies, drawn from 30 bites out of the 37 tagged Dependencies on Tezvyn. Answer them here or read straight down. Every question carries the correct option, why it is correct, and a link to the bite it came from.
30 questions. Pick an answer, or open “Show the answer” to read it.
Answers are graded in your browser. Nothing is saved, and no XP or streak is earned here. The app keeps score.
Question 1 of 30
Which scenario best demonstrates the appropriate use of an artifact repository?
Show the answer
Answer: a · Publishing a newly built Java .jar file to be consumed by other internal projects.
An artifact repository is designed to store and share binary outputs like compiled code (.jar files) from a build process for consumption by other systems or teams. Storing source code is for version control systems, while archiving unstructured logs or serving static assets are roles for general file storage or web servers, not artifact repositories.
Read the full bite: Artifact Repository: Your CI/CD's Private Library
Question 2 of 30
Why is it a problem to list a library your source code imports at runtime under devDependencies?
Show the answer
Answer: d · A production install that skips devDependencies leaves it missing, causing runtime errors
Production installs omit devDependencies, so a runtime import placed there will be absent and throw module-not-found. Runtime libraries must live under dependencies.
Read the full bite: dependencies vs devDependencies in package.json
Question 3 of 30
What core problem does committing package-lock.json solve that package.json alone cannot?
Show the answer
Answer: c · It guarantees every install resolves to the exact same dependency tree, including transitive packages
package.json uses version ranges, so installs can drift; the lockfile pins exact versions and tree shape for all transitive deps, making installs deterministic. It does not store tarballs or block additions.
Question 4 of 30
Given a dependency written as ^1.4.2, which upgrade would npm refuse to install on its own?
Show the answer
Answer: b · 2.0.0, a major release
The caret allows updates below the next major, so anything under 2.0.0 is permitted, but 2.0.0 itself is excluded. The tilde would be the operator that also blocks 1.7.0.
Read the full bite: SemVer and the caret vs tilde range operators
Question 5 of 30
An upstream service breaches its SLO solely because a downstream dependency had an outage. How should a well-designed error budget policy handle the burn?
Show the answer
Answer: c · Attribute the burn to the downstream service that caused the failure
Correct attribution charges the responsible downstream team, creating proper incentives and shielding the upstream victim. Charging the upstream team, splitting blindly, or ignoring it all distort accountability.
Read the full bite: Error budget policy across dependent microservices?
Question 6 of 30
What happens to a useEffect's cleanup and setup when a value in its dependency array changes?
Show the answer
Answer: a · React runs the previous cleanup with old values first, then runs setup with the new values
React always runs the previous effect's cleanup with the old dependency values before running the new setup when a dependency changes. The most tempting distractor is wrong because cleanup is not reserved for unmount; it runs whenever dependencies change to prevent stale subscriptions or leaks.
Read the full bite: Explain useEffect dependency array behavior for [], [deps], and omitted
Question 7 of 30
What is the primary function of the package.json file when a new developer sets up a Node.js project?
Show the answer
Answer: d · It lists all external code the project depends on and defines how to run common tasks.
The correct answer is B because package.json explicitly lists all external libraries (dependencies) required for the project and defines runnable scripts. This allows a new developer to quickly install everything with 'npm install' and run tasks like 'npm start', making the project self-contained and reproducible. Option B is incorrect because while package.json can suggest a Node.js version, its primary role for initial setup is dependency and script management.
Read the full bite: package.json: The Blueprint for Your Node.js Project
Question 8 of 30
What is the main reason for differentiating between "dependencies" and "devDependencies" in a Node.js project?
Show the answer
Answer: c · To reduce the final production bundle size and enhance security.
The card states this separation "prevents shipping unnecessary code to production, which saves disk space, reduces installation time, and minimizes the potential security attack surface." Option D is incorrect because the distinction aims to exclude development tools from production, not include them, to avoid bloat and security risks.
Read the full bite: Dependencies vs. DevDependencies: What's the Difference?
Question 9 of 30
A library updates from version 1.2.3 to 2.0.0. What does this change primarily signal to users?
Show the answer
Answer: b · Existing code using the library might break and require modifications.
A MAJOR version increment (from 1.x.x to 2.0.0) signals incompatible API changes, meaning existing code relying on the previous API may break. New backward-compatible features are MINOR changes, and bug fixes are PATCH changes.
Read the full bite: Semantic Versioning: A Contract for Your Code's Evolution
Question 10 of 30
What is the primary advantage of using an NPM scope (e.g., @my-org/package) for your packages?
Show the answer
Answer: b · It allows you to publish private packages and organize related modules under a shared namespace.
Option B accurately describes the core benefits of NPM scopes: they are mandatory for publishing private packages and provide a way to group related modules under a common, unique namespace. Option D is incorrect because the card states that scoped packages are public by default and require a specific flag for private access.
Read the full bite: NPM Scopes: Namespacing Packages to Avoid Collisions
Question 11 of 30
Three mandatory backends each have 99.95% availability. Why can the user-facing service not also reach 99.95% from these alone?
Show the answer
Answer: c · Because availabilities of serial dependencies multiply, yielding a lower combined number
For required dependencies in series the availabilities multiply, so 99.95% cubed is about 99.85%, already below target. Each critical dependency must be stricter, or you add redundancy and graceful degradation to break the serial chain.
Question 12 of 30
What is a key advantage of Swift Package Manager compared to previous dependency management tools?
Show the answer
Answer: c · It is a first-party, deeply integrated solution within Xcode.
The card states that Apple created SPM to be a "first-party, officially supported, and deeply integrated way to handle dependencies." The other options describe limitations or common misconceptions, as SPM may not support complex pre-build scripting, can still have version conflicts, and might not work with older, unmaintained libraries.
Read the full bite: Swift Package Manager: Native Dependency Management
Question 13 of 30
What is the core function of Gradle when managing build dependencies in an Android project?
Show the answer
Answer: c · To ensure that all external libraries and pre-built code are correctly integrated and available for the app.
The card states that Gradle's role is to "manage these 'build dependencies' to ensure they are correctly included and built into the final application" and is responsible for "finding them, integrating them, and assembling the final product." While Gradle orchestrates the compilation (Option D), its core function regarding dependencies is their integration.
Read the full bite: Adding Build Dependencies with Gradle in Android
Question 14 of 30
In a FastAPI dependency using yield, which statement accurately describes the execution flow?
Show the answer
Answer: d · Code before yield runs as setup, and code after yield runs as teardown post-response
The card explains that yield splits a dependency into setup (before yield) and teardown (after yield), with cleanup running only after the response is fully sent. Option B is a tempting distractor because candidates often assume the dependency resumes immediately after yielding, not realizing teardown waits until after the response completes.
Read the full bite: What is the purpose of yield in a dependency function?
Question 15 of 30
Which problem does a Python virtual environment primarily aim to solve?
Show the answer
Answer: d · Conflicts arising when different projects require incompatible versions of the same Python library.
The card explicitly states that virtual environments were created to solve 'dependency hell,' which arises when 'two different projects might require conflicting versions of the same library.' While virtual environments aid in reproducibility (which helps sharing), their primary purpose is to prevent these direct dependency conflicts.
Read the full bite: Python Virtual Environments: Isolate Project Dependencies
Question 16 of 30
A FastAPI endpoint depends on get_session, which yields and depends on get_pool, which also yields. What teardown order is guaranteed after the endpoint runs?
Show the answer
Answer: d · get_session tears down first, then get_pool, managed by FastAPI's internal stack
FastAPI uses an internal stack to ensure nested yield dependencies teardown bottom-up, so get_session closes before get_pool releases connections. Distractor A incorrectly assumes teardown mirrors setup order, which would risk resource leaks.
Read the full bite: How does FastAPI execute setup and teardown in nested yield dependencies?
Question 17 of 30
What is considered the "most critical footgun" when publishing a code package to a registry?
Show the answer
Answer: a · Accidentally including sensitive API keys or secrets in the package bundle.
The card explicitly states, "The most critical footgun is publishing packages containing secrets, API keys, or other sensitive data." While other options describe poor practices or less ideal scenarios, they are not identified as the "most critical footgun" in the text.
Read the full bite: Package Publishing: Sharing Your Code with the World
Question 18 of 30
What is the fundamental structure of a Semantic Versioning number?
Show the answer
Answer: a · A three-part number: Major.Minor.Patch.
The card explicitly states that the core of Semantic Versioning is a three-part Major.Minor.Patch number. While some implementations may extend it to four parts, this is not its fundamental structure.
Read the full bite: Semantic Versioning: A Three-Part Numbering System
Question 19 of 30
What is the primary reason developers must understand and manage transitive dependencies?
Show the answer
Answer: d · To prevent potential security vulnerabilities, version conflicts, and unnecessary code bloat.
The card explicitly states that understanding transitive dependencies is critical for debugging mysterious version conflicts, trimming application bloat, and securing the software supply chain. Option B is incorrect because while you can manage them, they are often necessary for direct dependencies to function, not always optional.
Read the full bite: Transitive Dependencies: The Hidden Baggage in Your Code
Question 20 of 30
You add an optional dependency libwebp-sys to your crate. Which statement accurately describes how consumers can enable it and how it affects compilation?
Show the answer
Answer: b · Consumers enable it by adding features = ["libwebp-sys"] to their dependency, and your code can gate WebP support with #[cfg(feature = "libwebp-sys")]
Optional dependencies implicitly create a Cargo feature with the same name, so consumers enable them via features = [...] and authors gate code with #[cfg(feature = ...)]. The dep: prefix is used to hide or group optional dependencies behind custom feature names, not to expose them.
Read the full bite: Explain Cargo features and how to define and enable them
Question 21 of 30
You manually add a require directive to go.mod and skip go mod tidy. Your build passes locally, but a teammate with a fresh module cache sees a security error. What explains this discrepancy?
Show the answer
Answer: c · Tidy computes the minimal build list via MVS and ensures go.sum contains checksums for every module in that list, including indirect dependencies. Without it, missing checksums cause verification failures on fresh caches.
go mod tidy computes the minimal build list using Minimal Version Selection and populates go.sum with checksums for every module, which fresh caches need for verification. Distractor A is tempting but incorrect because tidy does not upgrade dependencies to their latest versions; it only resolves the minimal versions actually imported by the code.
Read the full bite: What does go mod tidy do beyond adding dependencies?
Question 22 of 30
A platform team and three feature teams use SAFe with a Release Train Engineer tracking dependencies on a ROAM board. If they switch to LeSS, what replaces that formal coordination?
Show the answer
Answer: c · Collective Sprint Planning One, strong collaboration, and feature teams owning end-to-end value
LeSS replaces SAFe's formal coordination hierarchy with collective Sprint Planning One, multi-team collaboration, and feature teams that own end-to-end customer features. D describes SAFe's Program Increment planning, a common error made when treating the two frameworks as interchangeable.
Read the full bite: Compare SAFe and LeSS from an engineer's view
Question 23 of 30
A library at version 1.5.2 adds a new, backward-compatible feature and fixes a bug. What should the next version be?
Show the answer
Answer: b · 1.6.0
Adding a new, backward-compatible feature requires incrementing the MINOR version, and the PATCH version resets to 0. While a bug fix alone would increment the PATCH, the introduction of a new feature dictates the MINOR version increment and subsequent PATCH reset. Option D is incorrect because the PATCH version always resets to 0 when the MINOR version is incremented.
Read the full bite: Semantic Versioning: The MAJOR.MINOR.PATCH Contract
Question 24 of 30
What is the primary function of "linking" a native dependency in a React Native application?
Show the answer
Answer: d · To connect the native platform-specific code of the library to the React Native project's build system and runtime bridge.
Linking integrates the native code (like from CocoaPods for iOS or Gradle for Android) into the project's build system, making it accessible to the React Native bridge. Option C is incorrect because linking does not compile JavaScript; it connects existing native code.
Read the full bite: Linking Native Dependencies in React Native
Question 25 of 30
After adding a package's URL in Xcode, what final action makes its API usable in your code?
Show the answer
Answer: b · Selecting the package product and assigning it to a build target
The package only links once you choose its product and attach it to a target; until then the import is unavailable. pod install is CocoaPods, deleting the lockfile harms reproducibility, and the branch rule does not affect linking.
Read the full bite: Adding a Swift Package dependency in Xcode
Question 26 of 30
When would a design system team most likely opt for individual component versioning over whole library versioning?
Show the answer
Answer: c · When different product teams require maximum autonomy to update only the specific components they use.
Individual component versioning is favored when team autonomy is the highest priority, allowing teams to update specific components on their own schedule. Option D is incorrect because individual versioning can actually lead to dependency bloat and increased bundle size due to multiple versions of the same component.
Read the full bite: Design System Versioning: One Package or Many?
Question 27 of 30
What is the main risk of resolving npm audit findings by running npm audit fix --force?
Show the answer
Answer: a · It can install breaking major versions that silently break your application if untested
The --force flag installs out-of-range major versions to remediate, which can introduce breaking changes; you must test afterward. It does not delete the lockfile or disable future audits.
Read the full bite: Auditing and fixing vulnerable npm dependencies
Question 28 of 30
What is the primary benefit of using cargo add instead of manually editing the Cargo.toml file?
Show the answer
Answer: a · It ensures correct TOML syntax and automatically determines the latest compatible version for the added crate.
The card states that cargo add "automates this, ensuring correct syntax and fetching rules directly from the command line" and "prevents the manual syntax errors and version lookup." Option C is incorrect because cargo add is designed for adding/modifying dependencies for a single package, not for sweeping updates across an entire workspace.
Read the full bite: cargo add: Stop Editing Cargo.toml By Hand
Question 29 of 30
For which scenario would using Rust Cargo features be an inappropriate choice?
Show the answer
Answer: a · Allowing a user to select between two mutually exclusive data processing algorithms at runtime.
Cargo features are for compile-time configuration, not runtime choices. If a user needs to decide between options while the program is running, standard language constructs like enums or trait objects should be used instead. The other options describe valid use cases for Cargo features, as they involve compile-time conditional inclusion of code or dependencies.
Read the full bite: Rust Cargo Features: Conditional Compilation & Dependencies
Question 30 of 30
You build a Docker image for production using 'RUN npm install --only=production'. What happens if you accidentally listed Express as a devDependency?
Show the answer
Answer: a · Express is not installed, and the app crashes at startup because require('express') fails.
The --only=production flag installs only dependencies, skipping devDependencies. If Express is in the wrong category, it is not installed. The app requires Express at startup and immediately crashes. npm doesn't auto-correct; it trusts your categorization. The distinction is critical; incorrect categorization breaks production.
Read the full bite: dependencies vs devDependencies in production?
Could you explain these out loud?
That is what an interview actually tests. Tezvyn gives you questions like these with what the interviewer is really checking, the answer that lands, and the mistake that ends the conversation, in the four minutes before your next meeting.
The iPhone app is on the way
We are building it. Until it lands, nothing here is held back from you: every interview card, your saved cards, streaks and the job board all work in Safari, plus hundreds of free practice quizzes of thirty questions each. Sign in and it all carries over to the app the day it arrives.
Want it as an icon? Tap Share at the bottom of Safari, then Add to Home Screen. It opens full screen and the cards you have read stay available offline.