dependency

basicwidespread

A dependency is a ready-made piece of software, typically written by others, that a program is built on: without it, the program could not be built or run.

In plain terms

If you make scrambled eggs, you do not raise the chicken yourself, nor do you forge the pan: you rely on ready-made things. Programs are made the same way. The developer does not write everything from scratch but incorporates others' ready-made, tested code, for example for handling dates, payments, or displaying images. These built-in, external pieces are called dependencies.

The name indicates that the program depends on them from this point on: if the external component is missing, breaks, or changes, the program built on it will falter. In return, development is much faster and cheaper because there is no need to reinvent the wheel.

Dependencies have their own dependencies, so behind a seemingly simple application there are often hundreds or thousands of building blocks maintained by strangers. The app running on your phone therefore depends on the work of far more people than work at the company that makes it.

How it works

The developer records in a list which external packages the program needs and which versions of them.
A package manager tool downloads these from a public repository and also downloads the packages that the downloaded ones depend on.
Exact versions are recorded in a separate file so the program is assembled from the same components on every machine.
When a new version of a dependency appears, for example to fix a security vulnerability, the developer must update it and verify that the program still functions correctly afterward.
If a coding agent writes a program, it also selects and installs dependencies, so it is advisable for a human to review what was integrated.

An everyday example

You open the banking app and it requests an update, even though you see nothing new. A common reason is that a security flaw was found in one of the built-in external components, and the bank replaced it with the patched version.

Who is affected

developerEvery day, they decide what to build in, and they must keep the bundled packages up to date and secure. → Code

entrepreneur, executiveThe security and operational costs of your company's software largely depend on external code not written by your own people.

everyoneBehind your applications' updates and occasional outages often lies a bug in an embedded external component.

A common misconception

MythEvery line of an application was written by the company whose name is on it.

In realityMost of a program's code consists of external, typically open-source dependencies, on which the company's own code is built.

Limits and risks

A security flaw in a dependency makes every program built on it vulnerable, even if its own code is flawless.
Many important packages are maintained by a few volunteers who can stop working at any time.
Skipping updates is risky, but the update itself can break something, so testing is always required afterward.
A coding agent sometimes suggests non-existent or outdated packages, while attackers publish malicious packages under exactly such names.

Similar, but not the same

library – The library itself is a collection of reusable code, while the dependency is the relationship: the library becomes a dependency because your program builds on it.
API – An API is a gateway through which you call another system from the outside. A dependency, by contrast, is typically built into your own program. However, if your program does not work without an external service, it also counts as a dependency in a broader sense.
vendor lock-in – This is business dependency on a single provider, not a code snippet built into the program.

Related concepts

Broader

software development, software supply chain

Narrower

transitive dependency, development dependency

On the edge

library, Package manager, open source, semantic versioning, keretrendszer

A brief history

Reusing ready-made code snippets has been standard practice since the early decades of programming, and the widespread use of dependencies was made common by internet package repositories. In December 2021, a serious flaw in Log4j, a logging library embedded in countless systems (Log4Shell), made it known outside the profession how much risk a single dependency can carry.

Where things stand

By the end of 2026, virtually all software relies on dependencies, and coding agents routinely install them. Attention is increasingly turning to their security. Since September 2026, the EU Cyber Resilience Act has required manufacturers to report actively exploited vulnerabilities in their products. From December 2027 it will also require manufacturers to keep a record of the components built into their products, for example in the form of a software bill of materials (SBOM).

Status: 2026 November

In the news

Appears in 6 Agent Age stories; the curve shows weekly occurrence in the news magazine.

New York PSC orders utilities to document their AI use, citing dependency riskSep 28, 2026 · Ipar
AI chatbots and mental health: studies warn of psychological harmSep 28, 2026 · Health
New York audits utility AI use, citing risk in 'growing dependency'Sep 24, 2026 · Ipar
Moody's warns banks over their dependency on AI technologySep 7, 2026 · Money
Workers fear AI dependency more than job lossAug 17, 2026 · Work & HR
Moody's: AI race risks "systemic dependency" of big banks on tech firmsAug 10, 2026 · Money

Also known as

dependency · dependencies · software dependency · external dependency · dependency · dependencies · software dependency · deps

Sources

Wikipedia: Log4Shell

This entry was machine-edited and has undergone machine expert review; the “In the news” section updates automatically from Agent Age stories.