Free tools Windows power users keep installed
One-click scans. No signup required.
A package can break your build even if you never added it directly: one of your declared dependencies may require it, or it may sit several steps further down that dependency chain. Package managers resolve those chains recursively, so the packages in a build are not limited to the names in your project manifest.
What is a transitive dependency?
A direct dependency is a package your project requests. A transitive dependency is a package required by one of those direct dependencies, or by another package further down the chain. For example, if your application requests A, and A requires B, then B is transitive to your project. If B requires C, C is transitive too.
As an Amazon Associate I earn from qualifying purchases.
Package managers resolve these relationships recursively and install what the requested packages need. Google Cloud describes dependencies as a recursive tree of direct and indirect packages that can affect an application. See Google Cloud’s dependency-management overview, pip’s dependency-resolution documentation, and npm’s install documentation.
That is why “I never installed that package” does not establish that it is absent. You may not have requested it yourself, but a package you did request may have brought it into the resolved dependency tree.
#1 Best Overall
How can an indirect package break a build?
Two packages require incompatible versions
Imagine one requested package requires package_water>=2.4.2,<3.0.0, while another requires package_water==2.3.1. Those illustrative requirements cannot both be met by a single version. pip documents this kind of conflict: its resolver may backtrack through possible versions, but it ultimately reports an error if it cannot find a compatible set of requirements. The example package names are hypothetical; see pip’s explanation of dependency resolution.
The resolved tree changes
A manifest can permit a range of versions rather than pinning one exact version. If the existing lockfile no longer satisfies the manifest, a package manager may resolve different versions and update the recorded tree. npm documents that npm install uses compatible locked versions when the lockfile satisfies package.json, and resolves new versions and updates the lockfile when it does not. A changed indirect package can therefore surface a failure even when you did not edit that package directly. The precise behavior depends on the package manager and its files; see npm install documentation.
Your code relies on an undeclared package
Sometimes a package is importable only because another dependency caused it to appear in a location your code can see. If your project uses that package without declaring it, the import is a phantom dependency: it may work in the current layout and fail when the layout changes or the project is published. npm warns about this risk and recommends that package authors use --install-strategy=linked during development to help catch undeclared dependencies. That recommendation concerns npm’s strategy and is not a universal command for other ecosystems. See npm’s install documentation.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesWhat should you inspect first?
- Read the first meaningful error. Identify the package, version or version range named, and whether the message comes from dependency resolution, compilation, tests, or runtime execution. A resolver conflict points to incompatible requirements; a missing-module or import error may point to an undeclared dependency or a changed tree.
- Check the manifest and lockfile together. The manifest expresses what your project requests; the lockfile records a resolved state. In npm,
package-lock.jsonrecords the generated dependency tree. When you want an npm install that keeps the manifest and lockfile strictly in sync, npm documentsnpm cifor that purpose. See npm’s package-lock.json documentation and npm install documentation. - Trace the named package upward. Find which direct dependency requires it, then follow the chain if needed. Inspect the resolved tree using the tools and commands appropriate to your package manager; no single command or tree layout applies across npm, pip, and Cargo.
- For pip conflicts, compare constraints. Determine what each requested package requires of the shared dependency. pip supports constraint files to limit versions of indirect dependencies, but a constraint does not make incompatible requirements compatible. Apply one only when the selected version satisfies the packages’ actual compatibility requirements. See pip’s dependency-resolution documentation.
- Declare packages your project imports. If your own code imports a package, declare it as a direct dependency where appropriate rather than relying on another package to expose it accidentally. For npm package authors, the linked install strategy described above can help reveal this problem during development.
- Reproduce the recorded state when diagnosing. Use the ecosystem’s documented install mode for honoring or enforcing its lockfile, and avoid changing the lockfile while trying to determine whether the existing resolved tree is reproducible.
How npm, pip, and Cargo record and resolve dependencies
The files and install behavior differ by ecosystem, so do not assume that a command or lockfile rule from one applies to another.
| Ecosystem | Where resolved state is recorded | What the documentation says about installation or resolution | Conflict and undeclared-dependency clues |
|---|---|---|---|
| npm | package-lock.json records the generated dependency tree. (npm documentation) |
npm install uses compatible locked versions when the lockfile satisfies package.json; if it does not, npm resolves new versions and updates the lockfile. npm documents npm ci for installs that keep the manifest and lockfile strictly in sync. (npm documentation) |
npm warns that undeclared or “phantom” imports can work accidentally. It recommends --install-strategy=linked for package authors during development to help catch them. (npm documentation) |
| pip | A lockfile format is not stated in the cited dependency-resolution documentation. (pip documentation) | pip resolves dependencies recursively and can backtrack across candidate versions; its exact install and lockfile workflow should be checked in the context of the project. (pip documentation) | The resolver reports when requirements cannot be reconciled. Constraint files can limit indirect dependency versions, provided the chosen versions meet compatibility requirements. (pip documentation) |
| Cargo | Cargo.lock records the resolved versions. (Cargo Book, nightly documentation) |
Cargo resolves versions from requirements and records the result in Cargo.lock. Consult Cargo’s documentation for the relevant workflow and project context. (Cargo Book, nightly documentation) |
The cited resolver documentation establishes version resolution and lockfile recording; a specific undeclared-dependency detection strategy is not stated there. (Cargo Book, nightly documentation) |
Lockfiles help repeat a resolved dependency state; they do not prove that the source code, operating system, compiler, or other parts of the build environment are compatible. A reproducible set of package versions can still encounter a build failure caused by factors outside version resolution.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Why a lockfile may not prevent the failure
A lockfile captures resolved versions or a dependency tree according to that ecosystem’s rules. It cannot make incompatible requirements compatible, declare a package your code uses but your manifest omits, or guarantee that every machine has the same compiler and environment. When a failure appears after a dependency change, compare the current manifest and lockfile with the last known working versions, then determine whether the tree changed or the failure comes from another build condition.
Rank #4
npm’s behavior described above is specific to npm; pip and Cargo have their own resolution and recording rules. For Cargo, the Cargo Book describes resolving versions from requirements and recording the result in Cargo.lock; see its dependency-resolution reference.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
