Dev vs Runtime: Different Dependencies for Different Times

Software Supply Chain Security · 3:09

Listen on 93

Lyrics

[Verse 1]
When you're building software, dependencies divide
Some are for development, some run live
Testing frameworks and linters too
Help you code but users never need them through
Package dot json knows the way
DevDependencies won't ship today

[Chorus]
Dev time, runtime, different times indeed
Dev deps build it, runtime deps you need
Optional extras make it shine so bright
But core functionality works day and night
Separate your concerns, keep the bundle light
Dev time, runtime, getting dependencies right

[Verse 2]
Webpack bundles up your code with care
Leaves the dev tools behind, they don't go there
Jest and ESLint stay on your machine
Production builds keep dependencies clean
Supply chain matters when you deploy
Smaller bundles bring users joy

[Chorus]
Dev time, runtime, different times indeed
Dev deps build it, runtime deps you need
Optional extras make it shine so bright
But core functionality works day and night
Separate your concerns, keep the bundle light
Dev time, runtime, getting dependencies right

[Bridge]
Optional dependencies enhance the flow
Peer dependencies let compatibility grow
Security scanning needs development phase
Runtime attacks come in different ways
Know your graph from root to leaf
Dependency clarity brings relief

[Verse 3]
Geopolitical winds can shift the ground
Supply chain attacks move without a sound
Audit your runtime, trim what's not required
Keep dev dependencies locally acquired
Resilient systems plan for every case
When dependencies vanish without a trace

[Chorus]
Dev time, runtime, different times indeed
Dev deps build it, runtime deps you need
Optional extras make it shine so bright
But core functionality works day and night
Separate your concerns, keep the bundle light
Dev time, runtime, getting dependencies right

[Outro]
Build phase, ship phase, know them well
Dependencies have stories to tell
Dev time, runtime, plan it right
Keep your supply chain shining bright

← Dependency Graphs: The Web of Code Dependencies | Language Ecosystems: Package Managers Across the Stack →