> For the complete documentation index, see [llms.txt](https://hanfak.gitbook.io/workspace/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hanfak.gitbook.io/workspace/devops1/build-tools/managing-dependencies.md). # Managing dependecies * Build tools allows project manage and import dependencies. * Helps with stopping conflicts with different versions and transient dependencies * Always validate them * Understand the other dependencies that one dependency defined in config that will be brought in to the class path * check that these dependecies can be trusted * Do they meet requirements for app, deployment, environments, security, legal etc * Do not just trust them * They are still code * Most will come from open source * Are they being maintained? * ow you will need to do this? * How many contributors? * Documentation? * Are tests passing? Code coverage? * Maturity? * Check Issues? Are they resolved? * Vulnerable Dependencies * From a security point of view, you should scan your dependencies for known vulnerabilities. * Always update version which fixes these issues * There should be a plugin * Check issues on github * If cannot, make sure application can replace library easily * This applies to code in production * Always fix dependencies * And have schedule to update * Have a way of monitoring when an update is needed due to a vulnerabilities ## Bill of materials (BOM) * ## Minimise Dependencies * ## Versioning * Have fixed versions * ## Maintance * Always keep depencies up to date * ## Better to copy * depending on the license, it might be better to copy the functionality then import the whole library which contains lots of unneeded code and transitive dependencies * ## Links *