[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"glossary-package-manager::en":3,"gloss-cluster-package-manager::en":20,"gloss-next-package-manager::en":9},{"slug":4,"category":5,"name":6,"definition":7,"meta_desc":8,"faq":9,"schema_markup":9,"related":10},"package-manager","dev-tools","Package Manager","A package manager is a tool that automates installing, updating, configuring, and removing the third-party libraries (\"packages\" or \"dependencies\") a software project relies on, along with resolving the often-complex web of dependencies those packages themselves have. Examples include npm\u002Fpnpm\u002FYarn (JavaScript\u002FNode.js), pip\u002FPoetry\u002Fuv (Python), Cargo (Rust), Composer (PHP), and Bundler (Ruby). Why it matters for AI\u002FSaaS builders: almost no modern application is built entirely from scratch — a typical SaaS project depends on dozens to hundreds of third-party packages for things like HTTP handling, date parsing, authentication, and UI components, and manually tracking compatible versions of all of them (and their own sub-dependencies) by hand would be effectively impossible at any real scale. Package managers also matter enormously for supply-chain security: a compromised or malicious package pulled in as a transitive dependency is one of the more serious real-world attack vectors in modern software, which is why lockfiles and automated vulnerability scanning (`npm audit`, Dependabot) matter. How it works: a project declares its direct dependencies and version constraints in a manifest file (`package.json` for npm, `pyproject.toml` for Python). Running an install command resolves the full dependency tree — including dependencies of dependencies — down to exact versions, and writes those exact resolved versions to a lockfile (`package-lock.json`, `poetry.lock`) so that every developer and every CI run installs the identical dependency tree, not just \"any version that satisfies the constraints,\" which would risk subtle bugs from version drift between environments. Worked example: a developer wants to add date formatting to their Node.js project. They run `npm install date-fns`, which adds `date-fns` to `package.json`'s dependencies, downloads it and its (zero, in this case) sub-dependencies into `node_modules\u002F`, and records the exact resolved version in `package-lock.json`. A teammate clones the repo and runs `npm ci` (install exactly from the lockfile, not re-resolving), guaranteeing they get the byte-identical dependency tree, so \"it works on my machine\" can't be caused by a silent minor-version difference in a shared library. Three months later, an automated tool like Dependabot opens a pull request flagging that a transitive dependency of `date-fns` has a known security vulnerability, letting the team patch it with a single lockfile update rather than manually auditing every package in `node_modules` by hand. Multiplied across a real-world project with 300+ dependencies (a typical figure once every sub-dependency is counted, not just the ones a developer explicitly installed), this automated resolution and locking is the only practical way to keep a dependency tree both up to date and secure.","A package manager installs, updates, and resolves dependencies between third-party code libraries a project relies on.",null,[11,14,17],{"slug":12,"name":13},"cli","Command-Line Interface (CLI)",{"slug":15,"name":16},"monorepo","Monorepo",{"slug":18,"name":19},"sdk","Software Development Kit (SDK)",[21,25,28,32,35,38,41,44,47,50,53,54],{"slug":22,"category":5,"name":23,"updated_at":24},"agent","Agent","2026-08-24T02:46:36+00:00",{"slug":26,"category":5,"name":27,"updated_at":24},"ai-code-assistant","AI Coding Assistant",{"slug":29,"category":5,"name":30,"updated_at":31},"api-gateway","API Gateway","2026-08-24T02:46:37+00:00",{"slug":33,"category":5,"name":34,"updated_at":31},"api-versioning","API Versioning",{"slug":36,"category":5,"name":37,"updated_at":24},"autonomous-agent","Autonomous Agent",{"slug":39,"category":5,"name":40,"updated_at":31},"blue-green-deployment","Blue-Green Deployment",{"slug":42,"category":5,"name":43,"updated_at":31},"canary-deployment","Canary Deployment",{"slug":45,"category":5,"name":46,"updated_at":31},"chaos-engineering","Chaos Engineering",{"slug":48,"category":5,"name":49,"updated_at":24},"ci-cd","Continuous Integration \u002F Continuous Deployment (CI\u002FCD)",{"slug":51,"category":5,"name":52,"updated_at":31},"circuit-breaker","Circuit Breaker",{"slug":12,"category":5,"name":13,"updated_at":31},{"slug":55,"category":5,"name":56,"updated_at":31},"cloud-development-environment","Cloud Development Environment (CDE)"]