← ACARA Digital Technologies Years 9–10

Third-party dependencies

A library written by someone else that your program imports and relies on. A flaw in it affects every app that uses it, and it may pull in its own dependencies too.

Part of: ACARA Digital Technologies Years 9–10 — Cyber Security Threats and Vulnerabilities — Module 75, QCE Digital Solutions Unit 3 — Interactions Between Users, Data and Digital Systems — Module 64, QCE Digital Solutions Unit 4 — Complex Digital Data Exchange Problems and Solution Requirements — Module 118

Understanding Third-party dependencies in ACARA Digital Technologies Years 9–10

What it does: Installing a package like flask adds someone else's code to your project, which makes it a third-party dependency. The pip show command lists the Requires field, which reveals the extra libraries that flask brings in. These are dependencies of dependencies. A flaw in a shared library spreads to every app that imports it, which is why one bug can affect millions of users. import requests pulls in the requests library, which was written by other people. print() is a built-in function. Dependencies of dependencies are called indirect (transitive) dependencies. Their flaws can still affect your app. Installing one library can bring in many others. You may depend on code you never chose directly.

Common mistakes: Python uses the import keyword to load a third-party library. require is JavaScript syntax. The line should be import requests. The imported library is called requests, with an s. Using request means Python cannot find the dependency's name. It should be requests.get(url).

Class: _____________________ · Name: _____________________ · Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Third-party dependencies to a class →

This module's key terms are also in a printable crossword (Modules 810–827) and word search (Modules 810–859).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning

Duo

Which statement describes a third-party dependency?

A library written by someone else that your program imports and relies onA function you wrote yourself and saved in your own program

Matches

# I wrote all my own code, so no outside risk import numpy

↓

numpy is a library written by someone else, so it is a third-party dependency. It is outside code that can contain flaws.

Applying

Meanings

Term

third-party dependency

Meaning

A library written by someone else that your program imports and relies on. A flaw in it affects every app that uses it, and it may pull in its own dependencies too.

Practice

requests==2.31.0

Testing

Gaps

requests

Check Answer

Spots

1require requests

2r = requests.get(url)

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy

Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games

Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print

Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. Which statement describes a third-party dependency?

A. A library written by someone else that your program imports and relies on ✓

B. A function you wrote yourself and saved in your own program

A third-party dependency is code from outside your team, such as a library you import, so you rely on someone else's work.

2. A popular library has a security flaw. Which apps are affected?

A. Every app that uses that library ✓

B. Only the app of the person who wrote the library

A flaw in a shared library spreads to every app that imports it, which is why one bug can affect millions of users.

3. Which line shows a program using a third-party dependency?

A. print('Hello')

B. import requests ✓

import requests pulls in the requests library, which was written by other people. print() is a built-in function.

4. Your app imports Library A. Library A imports Library B. Is Library B part of your app's risk?

A. Yes, it is a dependency of a dependency and still runs in your app ✓

B. No, because you never imported Library B yourself

Dependencies of dependencies are called indirect (transitive) dependencies. Their flaws can still affect your app.

5. Why can a library you have never heard of still put your app at risk?

A. Libraries only run if you call them by name in your code

B. It may be pulled in automatically by another library you chose ✓

Installing one library can bring in many others. You may depend on code you never chose directly.

Match the Pairs

import requests → Your program loads a library written by someone else, so it now depends on that outside code

requests==2.19.0 (known flaw) → A flaw in this one library puts every app that uses this version at risk

A library you did not write is added to your project, so you must trust and keep track of it → pip install flask

A dependency can pull in its own dependencies, so your app relies on code you never chose directly → pip show flask

# I wrote all my own code, so no outside risk import numpy → numpy is a library written by someone else, so it is a third-party dependency. It is outside code that can contain flaws.

# I only installed one package, so I only depend on one library → One package can pull in several others. Your app also depends on those hidden dependencies of dependencies.

Key Term

third-party dependency

A library written by someone else that your program imports and relies on. A flaw in it affects every app that uses it, and it may pull in its own dependencies too.

Fill in the Blanks

1. import requests

Hint: Type the keyword that brings a third-party library into your program.

2. pip install requests

Hint: Type the pip command that downloads a library written by someone else.

3. requests==2.31.0

Hint: Type the operator that pins the dependency to one exact version.

4. pip show requests

Hint: Type the pip command that displays a package's details, including the other packages it requires.

5. import requests r = requests.get(url)

Hint: Type the name of the imported library so the program can use its code.

Spot the Error

Question 1

A require requests

B r = requests.get(url)

C print(r.status_code)

Line A — Python uses the import keyword to load a third-party library. require is JavaScript syntax. The line should be import requests.

Question 2

A import random

B import requests

C r = request.get(url)

D print(r.status_code)

Line C — The imported library is called requests, with an s. Using request means Python cannot find the dependency's name. It should be requests.get(url).

Question 3

A pip install flask

B pip install requests

C pip instal numpy

Line C — The pip command to download a dependency is spelled install, with two l's. The line should be pip install numpy.

Question 4

A {

B "dependency": {

C "express": "^4.18.2"

D }

E }

Line B — In package.json, the list of third-party libraries your app relies on is called dependencies, in the plural. The key should be "dependencies".

Question 5

A import requests

B u = 'https://example.com'

C r = requests.get[u]

Line C — Functions from a dependency are called with round brackets, not square brackets. The line should be r = requests.get(u).

Student with a class code? Join your class →