Know what you build with
Map the dependency graph
Distinguish direct, transitive, development, build, and runtime dependencies and identify which code reaches production.
8 minute lesson
Your application includes code you wrote and code selected by your dependencies. Start by seeing the complete graph.
Direct dependencies are only the first layer. Transitive packages, build plugins, CI actions, container bases, and downloaded binaries can all influence the artifact. Record where each class runs and what authority it receives.
Imagine an image upload service that imports one package. That package downloads a native image tool during installation. The downloaded binary never appears in the top-level manifest, but it still runs in production.
A dependency list without execution context is incomplete. Build tools can read CI secrets, while runtime packages can reach customer data. Record both the path into the project and the authority each component receives.
Generate the complete dependency tree for a small project and save the output. Pick one transitive package and show which direct dependency introduced it, where it runs, and whether removing the parent removes it. Then repeat the check for one build plugin or downloaded binary that the package tree does not show.
Lesson completed