Unit I · How your app runs
The code you did not write
An AI-built app usually pulls in dozens or hundreds of packages written by other people. Knowing how they are listed, pinned and updated keeps the app from changing under you.
Manifests and lock files
A manifest such as package.json (JavaScript), requirements.txt or pyproject.toml (Python) or composer.json (PHP) lists the packages your app asks for. A lock file such as package-lock.json or composer.lock records the exact versions that were installed, including the packages those packages need.
npm's documentation says the lock file is intended to be committed to your repository, so every install, on every machine, gets the same tree.
Reading a version number
Most packages follow Semantic Versioning: MAJOR.MINOR.PATCH. A patch release fixes bugs, a minor release adds features without breaking existing use, and a major release may break what used to work. In npm, a range such as ^2.4.0 accepts newer minor and patch releases of version 2, but not version 3.
Known problems
Package managers can check your installed versions against public lists of known vulnerabilities: npm audit for npm, and similar tools elsewhere. A report is a reason to read and update, not to panic: check whether the affected part is used by your app, update, and run your tests.
Words to know
- Dependency
- a package your code uses
- Manifest
- the list of packages your app asks for
- Lock file
- the record of exactly which versions were installed
- Semantic Versioning
- MAJOR.MINOR.PATCH numbering that signals breaking changes
Sources
- npm Docs: package-lock.json
- Semantic Versioning 2.0.0
- npm Docs: About semantic versioning
- npm Docs: npm audit
Checked October 17, 2026. Pages on other sites change; if a source no longer says what the lesson says, the source wins.