What Is a Package Manager?
How a Package Manager Handles Dependencies
What is a package manager? It is a tool that installs, updates and removes reusable code libraries, called packages, that a project depends on. Instead of copying code by hand, a developer lists the packages a project needs, and the package manager downloads them from a central registry along with their own requirements.
A dependency is any package that your code relies on. Those packages often depend on others, forming a tree. The package manager works out this tree so that every required piece is present and compatible. Common examples are npm for JavaScript, Composer for PHP and pip for Python.
Packages are published to registries, which are servers that store published versions of each package. A registry lets a project fetch the same code on any machine, whether public or private.
Version Ranges and Lock Files
Packages are released in numbered versions. Many ecosystems follow semantic versioning, in which the number that changes signals whether an update is a fix, a backwards-compatible addition or a breaking change. A project's manifest file usually allows a range of versions, so that compatible fixes can arrive automatically.
A lock file records the exact version of every package that was installed, for example package-lock.json or composer.lock. Its purpose is reproducibility: the same versions are installed on a developer's laptop, on a test server and on the live site, so behavior matches across environments. Many teams commit lock files for applications for this reason.
Frequently asked questions
Do I need a package manager to build a website?
Not for a simple static site or a small page written by hand in HTML and CSS. A package manager becomes useful once a project uses a framework, a plugin system or shared libraries, because managing those manually is slow and error-prone when versions need updating.
Is a package manager the same as a hosting platform?
No. A package manager handles code dependencies during development and deployment, while a hosting platform runs the finished application. Some platforms can run the package manager during deployment, which installs the dependencies on the server before the new version goes live. This is part of the wider CI/CD process.