Third-party dependencies

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. Which statement describes a third-party dependency?

A A library written by someone else that your program imports and relies on

B A function you wrote yourself and saved in your own program

2. A popular library has a security flaw. Which apps are affected?

A Every app that uses that library

B Only the app of the person who wrote the library

3. Which line shows a program using a third-party dependency?

A print('Hello')

B import requests

4. Your app imports Library A. Library A imports Library B. Is Library B part of your app's risk?

A Yes, it is a dependency of a dependency and still runs in your app

B No, because you never imported Library B yourself

5. Why can a library you have never heard of still put your app at risk?

A Libraries only run if you call them by name in your code

B It may be pulled in automatically by another library you chose

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1import requests		AA flaw in this one library puts every app that uses this version at risk
2requests==2.19.0 (known flaw)		BOne package can pull in several others. Your app also depends on those hidden dependencies of dependencies.
3A library you did not write is added to your project, so you must trust and keep track of it		Cnumpy is a library written by someone else, so it is a third-party dependency. It is outside code that can contain flaws.
4A dependency can pull in its own dependencies, so your app relies on code you never chose directly		DYour program loads a library written by someone else, so it now depends on that outside code
5# I wrote all my own code, so no outside risk import numpy		Epip show flask
6# I only installed one package, so I only depend on one library		Fpip install flask

Definitions

third-party dependency

Fill in the Blanks

Complete each line of code by filling in the missing parts.

______ requests

pip _______ requests

requests__2.31.0

pip ____ requests

import requests r = ________.get(url)

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A require requests

B r = requests.get(url)

C print(r.status_code)

Question 2

A import random

B import requests

C r = request.get(url)

D print(r.status_code)

Question 3

A pip install flask

B pip install requests

C pip instal numpy

Question 4

A {

B "dependency": {

C "express": "^4.18.2"

D }

E }

Question 5

A import requests

B u = 'https://example.com'

C r = requests.get[u]

Answer Key

Third-party dependencies

Section A: Quick Questions

A — A library written by someone else that your program imports and relies on

A — Every app that uses that library

B — import requests

A — Yes, it is a dependency of a dependency and still runs in your app

B — It may be pulled in automatically by another library you chose

Section B: Match the Pairs

import requests → Your program loads a library written by someone else, so it now depends on that outside code

requests==2.19.0 (known flaw) → A flaw in this one library puts every app that uses this version at risk

A library you did not write is added to your project, so you must trust and keep track of it → pip install flask

A dependency can pull in its own dependencies, so your app relies on code you never chose directly → pip show flask

# I wrote all my own code, so no outside risk import numpy → numpy is a library written by someone else, so it is a third-party dependency. It is outside code that can contain flaws.

# I only installed one package, so I only depend on one library → One package can pull in several others. Your app also depends on those hidden dependencies of dependencies.

Section C: Definitions

third-party dependency — A library written by someone else that your program imports and relies on. A flaw in it affects every app that uses it, and it may pull in its own dependencies too.

Section D: Fill in the Blanks

import requests

pip install requests

requests==2.31.0

pip show requests

import requests
r = requests.get(url)

Section E: Spot the Error

A — Python uses the import keyword to load a third-party library. require is JavaScript syntax. The line should be import requests.

C — The imported library is called requests, with an s. Using request means Python cannot find the dependency's name. It should be requests.get(url).

C — The pip command to download a dependency is spelled install, with two l's. The line should be pip install numpy.

B — In package.json, the list of third-party libraries your app relies on is called dependencies, in the plural. The key should be "dependencies".

C — Functions from a dependency are called with round brackets, not square brackets. The line should be r = requests.get(u).