Third-party dependencies

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. Which one describes a dependency?

A A function you wrote yourself that only you use

B A library written by someone else that your program imports and relies on

2. A popular library has a security flaw. Who is affected?

A Every app that uses that library

B Only the person who wrote the library

3. Which line shows your program using a dependency?

A import requests

B x = 5 + 3

4. Your app uses Library A. Library A uses Library B. What is Library B to your app?

A An indirect (transitive) dependency

B Not a dependency, because you did not import it

5. Library B has a vulnerability, and your app only imports Library A. Is your app at risk?

A No, because you never imported Library B directly

B Yes, because Library A relies on Library B

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1import requests		AIgnores indirect dependencies. If LibA relies on LibB, a flaw in LibB still affects your app.
2npm install express		BA library flaw affects every app that imports it, not only its author.
3A flaw in one popular library affects every app that uses it		CMyApp -> LibA -> LibB
4An indirect (transitive) dependency is a dependency of a dependency		Dapp1, app2, app3 -> import oldlib (flaw)
5My app is safe because I only import LibA, and the flaw is in LibB		EDownloads a package and adds it as a dependency, along with the packages that it depends on
6A flaw in a library only matters to the person who wrote it		FBrings in a third-party library written by someone else so your program can use and rely on it

Definitions

dependency

Fill in the Blanks

Complete each line of code by filling in the missing parts.

______ requests r = requests.get(url)

pip _______ requests

{ "____________": {"express": "4.18.2"} }

app imports libA libA imports libB app -> libA -> ____

npm _____

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A import requests

B url = 'https://example.com'

C r = requests.get(url)

D print(requests.status_code)

Question 2

A # requirements.txt

B requests=2.31.0

C flask==3.0.0

D numpy==1.26.4

Question 3

A pip install requests

B pip install flask

C pip freeze < requirements.txt

Question 4

A {

B "dependencies": {

C "express": "^4.18.2",

D "lodash" "^4.17.21"

E }

F }

Question 5

A # Dependency tree for myapp

B myapp -> requests

C urllib3 -> requests

D # urllib3 is a transitive dep

Answer Key

Third-party dependencies

Section A: Quick Questions

B — A library written by someone else that your program imports and relies on

A — Every app that uses that library

A — import requests

A — An indirect (transitive) dependency

B — Yes, because Library A relies on Library B

Section B: Match the Pairs

import requests → Brings in a third-party library written by someone else so your program can use and rely on it

npm install express → Downloads a package and adds it as a dependency, along with the packages that it depends on

A flaw in one popular library affects every app that uses it → app1, app2, app3 -> import oldlib (flaw)

An indirect (transitive) dependency is a dependency of a dependency → MyApp -> LibA -> LibB

My app is safe because I only import LibA, and the flaw is in LibB → Ignores indirect dependencies. If LibA relies on LibB, a flaw in LibB still affects your app.

A flaw in a library only matters to the person who wrote it → A library flaw affects every app that imports it, not only its author.

Section C: Definitions

dependency — A library or package written by someone else that your program imports and relies on. If it has a flaw, every app that uses it is affected, including via dependencies of dependencies.

Section D: Fill in the Blanks

import requests
r = requests.get(url)

pip install requests

{
  "dependencies": {"express": "4.18.2"}
}

app imports libA
libA imports libB
app -> libA -> libB

npm audit

Section E: Spot the Error

D — status_code belongs to the response object r that requests.get() returns, not to the requests library itself. It should be print(r.status_code).

B — A pinned version in requirements.txt uses a double equals sign. It should be requests==2.31.0.

C — The > symbol sends the list of installed dependencies into the file. Using < is the wrong direction. It should be pip freeze > requirements.txt.

D — In JSON, each key and value must be separated by a colon. It should be "lodash": "^4.17.21".

C — The arrow shows who relies on whom. requests relies on urllib3, so it should be requests -> urllib3. That makes urllib3 an indirect (transitive) dependency of myapp.