← Years 9–10 Digital Systems

Third-party dependencies

A library or package written by someone else that your program imports and relies on. If it has a flaw, every app that uses it is affected, including via dependencies of dependencies.

Part of: 9-10 Digital Technologies Vic Curric - Digital Systems and Security — Module 65, VCE Software Development - U4O2 - Cyber Security: secure software development practices — Module 40

Understanding Third-party dependencies in Years 9–10 Digital Systems

What it does: Many apps all import the same library, so one flaw in it puts every one of those apps at risk. MyApp imports LibA directly, and LibA imports LibB. LibB is an indirect dependency of MyApp, but a flaw in it still affects MyApp. A dependency is code written by someone else (a library or package) that your program imports and relies on. Library B is still needed for your app to run. Dependencies of your dependencies are called indirect or transitive dependencies. Indirect dependencies can hide risk, so a careful developer keeps track of the whole chain. Dependencies save time, but they are written by other people and can still contain vulnerabilities.

Common mistakes: status_code belongs to the response object r that requests.get() returns, not to the requests library itself. It should be print(r.status_code). A pinned version in requirements.txt uses a double equals sign. It should be requests==2.31.0.

Class: _____________________  ·  Name: _____________________  ·  Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Third-party dependencies to a class →

This module's key terms are also in a printable crossword (Modules 41–69) and word search (Modules 41–79).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning
Duo
Which one describes a dependency?
A function you wrote yourself that only you useA library written by someone else that your program imports and relies on
Matches
My app is safe because I only import LibA, and the flaw is in LibB
↓
Ignores indirect dependencies. If LibA relies on LibB, a flaw in LibB still affects your app.
Applying
Meanings
Term
dependency
Meaning
A library or package written by someone else that your program imports and relies on. If it has a flaw, every app that uses it is affected, including via dependencies of dependencies.
Practice
{
Testing
Gaps
requests
Check Answer
Spots
3r = requests.get(url)
4print(requests.status_code)

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

The 'Polar Bear' badge — Data Heavyweight, one of Cloodit's 106 collectible badges
Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy
Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games
Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print
Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. Which one describes a dependency?
A. A function you wrote yourself that only you use
B. A library written by someone else that your program imports and relies on ✓
A dependency is code written by someone else (a library or package) that your program imports and relies on.
2. A popular library has a security flaw. Who is affected?
A. Every app that uses that library ✓
B. Only the person who wrote the library
The flaw is shared with every app that imports the library, so many apps can be at risk at once.
3. Which line shows your program using a dependency?
A. import requests ✓
B. x = 5 + 3
import requests loads a package written by someone else. Adding two numbers uses only built-in features.
4. Your app uses Library A. Library A uses Library B. What is Library B to your app?
A. An indirect (transitive) dependency ✓
B. Not a dependency, because you did not import it
Library B is still needed for your app to run. Dependencies of your dependencies are called indirect or transitive dependencies.
5. Library B has a vulnerability, and your app only imports Library A. Is your app at risk?
A. No, because you never imported Library B directly
B. Yes, because Library A relies on Library B ✓
A flaw in an indirect dependency can still affect your app, even if you never wrote an import line for it.

Match the Pairs

import requests → Brings in a third-party library written by someone else so your program can use and rely on it
npm install express → Downloads a package and adds it as a dependency, along with the packages that it depends on
A flaw in one popular library affects every app that uses it → app1, app2, app3 -> import oldlib (flaw)
An indirect (transitive) dependency is a dependency of a dependency → MyApp -> LibA -> LibB
My app is safe because I only import LibA, and the flaw is in LibB → Ignores indirect dependencies. If LibA relies on LibB, a flaw in LibB still affects your app.
A flaw in a library only matters to the person who wrote it → A library flaw affects every app that imports it, not only its author.

Key Term

dependency
A library or package written by someone else that your program imports and relies on. If it has a flaw, every app that uses it is affected, including via dependencies of dependencies.

Fill in the Blanks

1. import requests r = requests.get(url)
Hint: Type the keyword that loads a library written by someone else into your program
2. pip install requests
Hint: Type the pip command word that downloads and adds a package to your project
3. { "dependencies": {"express": "4.18.2"} }
Hint: Type the package.json key that lists the packages your app relies on
4. app imports libA libA imports libB app -> libA -> libB
Hint: Type the library that your app relies on only indirectly, through another library
5. npm audit
Hint: Type the npm command that scans your dependencies for known vulnerabilities

Spot the Error

Question 1
A import requests
B url = 'https://example.com'
C r = requests.get(url)
D print(requests.status_code)
Line D — status_code belongs to the response object r that requests.get() returns, not to the requests library itself. It should be print(r.status_code).
Question 2
A # requirements.txt
B requests=2.31.0
C flask==3.0.0
D numpy==1.26.4
Line B — A pinned version in requirements.txt uses a double equals sign. It should be requests==2.31.0.
Question 3
A pip install requests
B pip install flask
C pip freeze < requirements.txt
Line C — The > symbol sends the list of installed dependencies into the file. Using < is the wrong direction. It should be pip freeze > requirements.txt.
Question 4
A {
B "dependencies": {
C "express": "^4.18.2",
D "lodash" "^4.17.21"
E }
F }
Line D — In JSON, each key and value must be separated by a colon. It should be "lodash": "^4.17.21".
Question 5
A # Dependency tree for myapp
B myapp -> requests
C urllib3 -> requests
D # urllib3 is a transitive dep
Line C — The arrow shows who relies on whom. requests relies on urllib3, so it should be requests -> urllib3. That makes urllib3 an indirect (transitive) dependency of myapp.

Student with a class code? Join your class →