Package Management

Every language has its own ecosystem for managing dependencies. Here's how different languages handle package management, dependency resolution, and project configuration.

Installing & Managing Dependencies

JavaScript

# npm (Node Package Manager)
npm init -y                    # Create package.json
npm install express            # Install dependency
npm install -D jest            # Install dev dependency
npm install                    # Install all from package.json
npm update                     # Update packages
npm uninstall express          # Remove package

# yarn (alternative)
yarn init -y
yarn add express
yarn add -D jest
yarn install
yarn remove express

# pnpm (fast alternative)
pnpm install express
pnpm add -D jest

# Config file: package.json
# Lock file: package-lock.json / yarn.lock / pnpm-lock.yaml
# Registry: npmjs.com

PHP

# Composer
composer init                       # Create composer.json
composer require slim/slim          # Install dependency
composer require --dev phpunit/phpunit  # Dev dependency
composer install                    # Install from composer.json
composer update                     # Update packages
composer remove slim/slim           # Remove package

# Autoloading
# composer.json: "autoload": { "psr-4": { "App\\": "src/" } }
composer dump-autoload              # Regenerate autoloader

# Global install
composer global require friendsofphp/php-cs-fixer

# Config file: composer.json
# Lock file: composer.lock
# Registry: packagist.org

Rust

# Cargo (built-in)
cargo new my_project               # Create project
cargo init                         # Init in existing dir
cargo add serde                    # Add dependency
cargo add tokio --features full    # With features
cargo add --dev mockall            # Dev dependency
cargo build                        # Build & fetch deps
cargo update                       # Update dependencies
cargo remove serde                 # Remove package

# Cargo.toml (manifest)
# [dependencies]
# serde = { version = "1.0", features = ["derive"] }
# tokio = { version = "1", features = ["full"] }
#
# [dev-dependencies]
# mockall = "0.11"

# Config file: Cargo.toml
# Lock file: Cargo.lock
# Registry: crates.io

Go

# Go Modules (built-in since Go 1.11)
go mod init github.com/user/project  # Create go.mod
go get github.com/gin-gonic/gin      # Add dependency
go get -u github.com/gin-gonic/gin   # Update package
go mod tidy                          # Clean unused deps
go mod download                      # Download all deps
go mod vendor                        # Create vendor dir

# go.mod example:
# module github.com/user/project
# go 1.21
# require (
#     github.com/gin-gonic/gin v1.9.1
# )

# Config file: go.mod
# Lock file: go.sum
# Registry: pkg.go.dev (proxy.golang.org)

Python

# pip (built-in)
pip install requests               # Install package
pip install requests==2.31.0       # Specific version
pip install -r requirements.txt    # From requirements file
pip uninstall requests             # Remove package
pip freeze > requirements.txt      # Export installed

# Virtual environments
python -m venv .venv               # Create venv
source .venv/bin/activate          # Activate (Linux/Mac)
.venv\Scripts\activate             # Activate (Windows)
deactivate                         # Deactivate

# Poetry (modern alternative)
poetry init                        # Create pyproject.toml
poetry add requests                # Add dependency
poetry add --group dev pytest      # Dev dependency
poetry install                     # Install all

# Config file: requirements.txt / pyproject.toml
# Lock file: poetry.lock
# Registry: pypi.org

Zig

# Zig Package Manager (build.zig.zon)
# Zig uses a decentralized package system

# build.zig.zon example:
# .{
#     .name = "my_project",
#     .version = "0.1.0",
#     .dependencies = .{
#         .httpz = .{
#             .url = "https://github.com/...",
#             .hash = "...",
#         },
#     },
# }

# In build.zig:
# const dep = b.dependency("httpz", .{});
# exe.root_module.addImport("httpz", dep.module("httpz"));

zig build                          # Build with deps
zig fetch <url>                    # Fetch and hash a dep

# Config file: build.zig.zon
# Lock file: build.zig.zon (hashes inline)
# Registry: No central registry (URL-based)

C#

# NuGet (.NET package manager)
dotnet new console                     # Create project
dotnet add package Newtonsoft.Json      # Add package
dotnet add package xunit --version 2.5 # Specific version
dotnet restore                         # Restore packages
dotnet remove package Newtonsoft.Json   # Remove
dotnet list package                    # List installed

# .csproj example:
# <ItemGroup>
#   <PackageReference Include="Newtonsoft.Json"
#                     Version="13.0.3" />
# </ItemGroup>

# NuGet CLI
nuget install Newtonsoft.Json

# Config file: *.csproj
# Lock file: packages.lock.json (opt-in)
# Registry: nuget.org

C++

# vcpkg (Microsoft)
vcpkg install nlohmann-json        # Install package
vcpkg install boost:x64-linux      # Platform-specific
vcpkg list                         # List installed

# Conan (another popular option)
conan install .                    # Install from conanfile
conan search boost                 # Search packages

# CMake FetchContent (built-in)
# CMakeLists.txt:
# include(FetchContent)
# FetchContent_Declare(json
#   GIT_REPOSITORY https://github.com/...
#   GIT_TAG v3.11.2)
# FetchContent_MakeAvailable(json)

# Config: CMakeLists.txt / conanfile.txt / vcpkg.json
# Registry: vcpkg.io / conan.io

C

# No standard package manager
# Common approaches:

# System package managers
apt install libssl-dev             # Debian/Ubuntu
brew install openssl               # macOS
yum install openssl-devel          # RHEL/CentOS

# vcpkg (works for C too)
vcpkg install curl

# CMake FetchContent
# include(FetchContent)
# FetchContent_Declare(cjson
#   GIT_REPOSITORY https://github.com/...
#   GIT_TAG v1.7.15)

# pkg-config (find installed libraries)
pkg-config --cflags --libs openssl

# Manual: download, compile, link
# gcc main.c -lssl -lcrypto

Java

# Maven
mvn archetype:generate             # Create project
# pom.xml:
# <dependency>
#     <groupId>com.google.guava</groupId>
#     <artifactId>guava</artifactId>
#     <version>32.1.2-jre</version>
# </dependency>
mvn install                        # Install dependencies
mvn clean package                  # Build

# Gradle (alternative)
# build.gradle:
# dependencies {
#     implementation 'com.google.guava:guava:32.1.2-jre'
#     testImplementation 'org.junit.jupiter:junit-jupiter:5.10.0'
# }
gradle build                       # Build

# Config: pom.xml / build.gradle
# Registry: Maven Central (search.maven.org)

Ruby

# Bundler + RubyGems
gem install bundler                # Install bundler
bundle init                        # Create Gemfile
bundle add sinatra                 # Add gem

# Gemfile example:
# source 'https://rubygems.org'
# gem 'sinatra', '~> 3.0'
# gem 'rspec', group: :development

bundle install                     # Install all gems
bundle update                      # Update gems
bundle exec ruby app.rb            # Run with bundle

# Direct gem install
gem install rails
gem list                           # List installed
gem uninstall rails

# Config file: Gemfile
# Lock file: Gemfile.lock
# Registry: rubygems.org

Swift

# Swift Package Manager (built-in)
swift package init --type executable  # Create project

# Package.swift example:
# let package = Package(
#     name: "MyApp",
#     dependencies: [
#         .package(url: "https://github.com/vapor/vapor.git",
#                  from: "4.0.0"),
#     ],
#     targets: [
#         .executableTarget(name: "MyApp",
#                          dependencies: ["Vapor"]),
#         .testTarget(name: "MyAppTests",
#                    dependencies: ["MyApp"]),
#     ]
# )

swift build                        # Build & fetch deps
swift package update               # Update dependencies
swift package resolve              # Resolve versions

# Config file: Package.swift
# Lock file: Package.resolved
# Registry: Swift Package Index (swiftpackageindex.com)

Key Takeaways

• Centralized vs decentralized registries -- npm, PyPI, Crates.io, NuGet, and Maven Central are centralized; Go uses module proxies (defaulting to proxy.golang.org); Zig uses URL-based fetches with no central registry.
• Lock files ensure reproducibility -- Most ecosystems use lock files (package-lock.json, Cargo.lock, go.sum, Gemfile.lock, poetry.lock); C/C++ often rely on vendoring or system packages with less guarantees.
• Tooling maturity varies -- JavaScript has npm/yarn/pnpm; Python has pip plus Poetry/uv; Rust's Cargo is highly integrated; C and C++ use vcpkg, Conan, or CMake FetchContent with more manual setup.
• Virtual environments isolate dependencies -- Python's venv and Ruby's Bundler provide project-local isolation; Node's node_modules and Go's module cache serve similar goals.
• C has no standard package manager -- Developers typically use system package managers (apt, brew), vcpkg, or manual compilation; dependency management is largely manual.