Dependencies
37 bites tagged Dependencies — interview questions with model answers, and 60-second explainers.
dependencies vs devDependencies in production?
Dependencies are needed at runtime, devDependencies only for development. npm install includes both, npm ci --only=production excludes dev. understanding package requirements and deployment optimization.
Auditing and fixing vulnerable npm dependencies
Run npm audit (or yarn audit) to list advisories, npm audit fix to patch within semver, bump majors deliberately, and lock versions; wire audits into CI. Practical dependency hygiene.
SemVer and the caret vs tilde range operators
MAJOR.MINOR.PATCH signals breaking/feature/fix; caret allows minor and patch updates, tilde allows only patch; use tilde for tighter control. understanding version ranges.
Why package-lock.json must be committed
Lockfile pins exact versions of the whole dependency tree including transitive deps; guarantees identical installs across machines and CI. understanding reproducible installs.
dependencies vs devDependencies in package.json
Dependencies ship and run in production; devDependencies are only for development; omitted with npm install --production. understanding runtime versus build/test tooling.
Setting SLOs across a dependency chain
Serial dependencies multiply, so each backend needs a tighter SLO than the target; mitigate with redundancy, caching, and graceful degradation. Reliability math across dependencies.
Error budget policy across dependent microservices?
Set per-service SLOs but anchor on user-facing journey SLOs, budget for dependency error via the multiplication of availabilities, attribute downstream-caused failures correctly, and use… SLO design in a dependency graph.
Python Virtual Environments
A virtual environment is an isolated Python installation with its own packages, so each project gets the exact dependency versions it needs without conflicting with other projects or the system Python.
Resolving Conflicting Transitive Versions in SPM
SPM allows only one version per package, so diagnose the graph, then update, pin, or fork to find an overlap. understanding of SPM's single-version resolution. assuming both versions can coexist like in some other ecosystems.
Adding a Swift Package dependency in Xcode
Add via File menu, paste the repo URL, choose a version rule like up-to-next-major, link the product to your target. basic SPM workflow knowledge.
Explain useEffect dependency array behavior for [], [deps], and omitted
It tests reactive dependency tracking. Omitting re-runs every render; [] runs on mount with cleanup on unmount; [deps] re-runs when Object.is detects change. Red flag: claiming [] means 'run once' without mentioning cleanup or stale values.
How does FastAPI execute setup and teardown in nested yield dependencies?
It tests FastAPI's dependency injection lifecycle and stack-like teardown for nested yield dependencies. Setup runs top-down; teardown runs bottom-up after the response. A red flag is claiming teardown order is arbitrary or follows garbage collection.
What is the purpose of yield in a dependency function?
Tests teardown logic in FastAPI dependencies. Yield splits setup from cleanup: code before yield runs pre-request, after yield runs post-response to close resources like DB sessions. Red flag: confusing it with return or thinking yield is only for generators.
Why avoid global Python dependencies for ML, and how do containers help?
This probes environment isolation and reproducibility in ML. A strong answer cites global dependency conflicts, system library skew, and brittle environments; then notes containers freeze the full stack for deterministic deployment.
What does go mod tidy do beyond adding dependencies?
Tests reproducible Go module graph knowledge. A strong answer covers that tidy reconciles imports with go.mod, prunes unused modules, and ensures go.sum contains every checksum for the minimal build list.
Explain Cargo features and how to define and enable them
This tests conditional compilation and optional dependency design in Rust. A strong answer outlines the [features] table, cfg attribute gating, and consumer enablement via --features or default features.
Compare SAFe and LeSS from an engineer's view
Tests whether you see scaling frameworks as workflow design choices. Answers contrast SAFe's PI planning and RTE-managed dependencies with LeSS's single Sprint planning and team-driven resolution. Red flag: calling them interchangeable without citing autonomy.
How do you resolve a cross-team dependency in scaled agile?
This tests your ability to navigate organizational complexity and take ownership. First, validate the blocker and try direct peer contact. Then, escalate via Scrum of Scrums or PM syncs, proposing technical solutions like API contracts.
Linking Native Dependencies in React Native
Installing a native library is a two-step process: fetch the JS code, then link the native iOS/Android parts. This is required for packages like `react-native-webview` that need native APIs. The footgun is forgetting to run `pod install` for iOS and rebuild.
package-lock.json: Your Dependency Blueprint
package-lock.json is a blueprint for your node_modules, ensuring everyone on your team installs the exact same dependency versions. It's auto-generated by npm to prevent 'works on my machine' bugs. The footgun is ignoring it or manually editing it.
Dependency Scanning with npm audit
Think of dependency scanning as a background check for your code. `npm audit` compares your project's packages against a database of known security flaws, telling you if you're using vulnerable code. The biggest footgun is blindly running `npm audit fix`.
NPM Scopes: Namespacing Packages to Avoid Collisions
NPM scopes act like a personal folder for your packages, using the `@scope/package` format to avoid name collisions. They are essential for publishing private packages for your team or grouping related public ones.
Dependencies vs. DevDependencies: What's the Difference?
Dependencies are packages your app needs to run in production (like a web framework). DevDependencies are for your development workflow (like a test runner). The footgun is mixing them up, which bloats your production build with unnecessary code.
package.json: The Blueprint for Your Node.js Project
The package.json file is the blueprint for a Node.js project, listing its dependencies and runnable scripts. It's essential for installing libraries (`npm install`) and running tasks (`npm test`).
Get Dependencies bites daily.
Five a day, five minutes, offline. With quizzes so it sticks.
Open testing — you’ll join as an early tester.