This model is, of course, extremely simple. (Furthermore, npm 3 performs some optimizations to attempt to share dependencies when it can, but those are ultimately unnecessary to actually understanding the model.) The above diagram is something of a simplification: in practice, each transitive dependency would have its own node_modules directory and so on, but the directory structure can get pretty messy pretty quickly. Notably, the directory structure very closely mirrors the actual dependency tree. In the aforementioned example, the resulting directory structure would look something like this: node_modules/ In contrast, npm has a somewhat easier job: itвЂ™s totally okay with installing different versions of the same package because each package gets its own set of dependencies. In that sense, one of the package managerвЂ™s primary responsibilities is to figure out a set of package versions that will satisfy every version constraint simultaneously. This is because, in most package management models, only one version of any particular package can be installed at a time. Most package managers (including RubyGems/Bundler, pip, and Cabal) would simply barf here, reporting a version conflict. However, consider the case of hello: both packages require conflicting versions. Obviously, the world and goodbye dependencies are totally unrelated, so how npm handles them is relatively uninteresting. Imagine an application that depends on both foo and bar. Each of them have their own set of dependencies, which can be represented as a tree: foo Obviously, virtually every single package manager in existence has to model a dependency tree at some point, since thatвЂ™s how dependencies are expressed by programmers.ДЇor example, consider two packages, foo and bar. That is, every package installed gets its own set of dependencies rather than forcing every package to share the same canonical set of packages. Most users of npm (or at least most package authors) eventually learn that, unlike other package managers, npm installs a tree of dependencies. Dependency duplication and the dependency tree The tricky bit is determining when this is safe and when itвЂ™s not, and this is what I so frequently find that people get wrong. Indeed, it is often safe for a library author to pin a dependency to a specific version without affecting dependent packages or applications.

This is rather important in any ecosystem, since locking a library to a specific set of dependencies could cause significant problems, but itвЂ™s actually much less of a problem in npmвЂ™s case compared to other, similar package systems. npm happens to use the semver versioning scheme to express those ranges, but the way it performs version resolution is mostly immaterial what matters is that packages can depend on ranges rather than specific versions of packages. First, the basicsДЄt a high level, npm is not too dissimilar from other package managers for programming languages: packages depend on other packages, and they express those dependencies with version ranges. Unfortunately, in my experience, it is actually not particularly well understood, so consider this an attempt to clarify how exactly it works and how it affects you as a user or package developer.

Even tools like Bower are being pushed to the wayside in favor of the One True Package Manager, but whatвЂ™s most interesting to me is npmвЂ™s relatively novel approach to dependency management.

Sure, there are alternatives, but for the time being, npm seems to have won. Currently, npm is the package manager for the frontend world.

Npm devdependencies vs dependencies