Libraries, frameworks, packages, and dependencies

Consider a small startup that releases an application capable of accepting payments, sending emails, resizing photographs, and displaying charts.

Each of those capabilities could take a great deal of time and expertise to build from the beginning. Payment processing alone involves banks, card networks, fraud prevention, security requirements, and many other systems.

How can a small team release all of this within a few months?

The answer is that modern software teams rarely build every capability themselves, combining their own code with reusable code, tools, and external services created by other people and companies.

Software is built from existing building blocks

Imagine that a team needs to display a chart.

The engineers could write all the code required to draw lines, position labels, respond to clicks, and resize the chart for different screens, but another team may have already created reusable code that handles those common problems.

Instead of rebuilding everything, the engineers can use that existing code and focus on what is unique about their own product.

This is another example of abstraction. The team can use a capability without needing to recreate or understand every internal detail behind it.

What is a library?

A libraryConcept · lights on your maplibraryA collection of reusable code that solves a particular category of problems (dates, charts, image resizing) and that your code calls when needed. A toolbox. Your application decides when to pick up a tool. is a collection of reusable code designed to solve a particular category of problems.

A library might help engineers:

• Work with dates and time zones
• Create charts
• Resize images
• Validate information
• Send network requests
• Perform mathematical calculations

The application remains in control. It uses the library when it needs one of its capabilities.

You can think of a library as a toolbox. It contains useful tools, but your code decides when to pick one up and use it.

For example, an application might call a library function to convert a date from one time zone to another, so the engineers do not need to rebuild all the complicated rules governing time zones themselves.

What is a framework?

A frameworkConcept · lights on your mapframeworkA larger structure for building a particular kind of application, the frame of a house that the team fills in. It organizes the major parts and runs your code at the right moments. Your code calls a library; a framework calls your code. provides a larger structure for building a particular kind of software.

Instead of solving only one narrow problem, a framework may establish how major parts of an application should be organized and how they should work together.

You can think of a framework as the frame of a house, providing an overall structure while the development team fills in the parts that make the product unique.

Frameworks often make decisions about:

• How code should be organized
• How pages or screens are created
• How requests are handled
• When particular sections of code run
• How common application features fit together

A popular distinction is: your code calls a library, while a framework calls your code.

This is a helpful starting point. With a library, your application usually decides when to use the borrowed capability, while with a framework, the framework often controls the broader flow and runs your code at the appropriate time.

The boundary is not always exact. Some tools contain characteristics of both libraries and frameworks, and engineers may classify the same technology differently in casual conversation.

Examples you may hear

Several common names help place these ideas on a map.

React is a JavaScript library used to build user interfaces, though people sometimes casually refer to it as a frontend framework because it can be part of a larger application structure.

Next.js is a web framework built around React, providing additional structure and capabilities for creating complete web applications.

Django is a Python web framework. It provides tools and conventions for building backend web applications.

Node.js is neither a library nor a framework but a runtime that allows JavaScript code to run outside a web browser, including on servers.

You do not need to memorize the technical details of these tools because the main goal is to recognize which category each name belongs to.

What is a package?

Reusable code needs a convenient way to be distributed from its creators to other projects.

A packageConcept · lights on your mappackageA bundle of code and related information prepared so it can be installed and used by another project; it might contain a library, a framework, or a tool. Stored in package registries, public or private. is a bundle of code and related information prepared so that it can be installed and used by another project.

A package might contain:

• A library
• A framework
• A development tool
• Reusable application components
• Information about its version and dependencies

Packages are stored in collections called package registries. Some registries are public and contain packages available to the broader developer community, while companies may also operate private registries for code used only inside their organization.

A package and a library are therefore not exactly the same thing. A library describes what the reusable code does. A package describes how code is bundled and distributed.

What is a package manager?

A package managerConcept · lights on your mappackage managerThe tool that finds, downloads, installs, updates, and tracks a project’s packages (npm for JavaScript, pip for Python). One command, and the package lands in the project. is a tool that finds, downloads, installs, updates, and tracks packages for a software project.

JavaScript projects commonly use a package manager called npm. Python projects commonly use pip.

An engineer working on a JavaScript project might enter a command such as: npm install stripe

This installs Stripe’s JavaScript package into the project.

However, it does not download Stripe’s entire payment-processing system. That complex infrastructure continues to run remotely on Stripe’s own systems.

The installed package gives the application convenient code for communicating with Stripe’s external service. The startup combines:

• Its own application code
• Stripe’s reusable package
• Stripe’s remote payment service

This distinction connects directly to APIs and third-party services, which you will explore later.

What is a dependency?

A dependencyConcept · lights on your mapdependencyCode, software, or another component that a project relies on in order to function. Dependencies have dependencies of their own (transitive dependencies), so an app may indirectly rely on hundreds of packages. One of the most reused words in engineering. is code, software, or another component that a project relies on in order to function.

When a team installs a package, that package usually becomes a dependency of the project.

Dependencies can include:

• Libraries
• Frameworks
• Development tools
• Internal company packages
• Other supporting software

Dependencies can also depend on additional packages, which are sometimes called transitive dependencies.

As a result, an application may directly install only a few dozen packages while indirectly relying on hundreds or thousands of others.

This creates a dependency chain: your application depends on a package, which depends on other packages, which may depend on still more packages.

Why teams think carefully about dependencies

Dependencies allow teams to build software much faster because engineers can reuse tested solutions instead of recreating every common capability.

However, every dependency also introduces considerations.

A dependency may:

• Contain a security vulnerability
• Stop receiving updates
• Introduce a bug
• Become incompatible with newer software
• Increase the application’s size or complexity
• Change in a way that breaks existing behavior

When engineers debate whether to “add another dependency,” they are weighing immediate convenience against long-term maintenance and risk.

This does not mean dependencies are bad. Modern software could not be built efficiently without them, but teams should understand what they are relying on and manage those dependencies carefully.

Borrowed code and external services

It is helpful to distinguish two ways a team can use work created by others.

With a library or package, reusable code becomes part of the team’s project and runs within its software environment.

With an external service, another company operates the underlying system remotely, and the application communicates with that service, often through an API or SDK.

For example:

• A charting library may draw charts inside the application.
• An image-processing package may resize files using the application’s own computing resources.
• A payment provider may process payments on its remote systems.
• An email provider may send messages through infrastructure it operates.

Most modern products combine their own code, reusable packages, frameworks, and external services. Nobody writes alone.

The mental model to remember

A library is a collection of reusable code that solves a particular category of problems.

A framework provides a broader structure for building a type of application.

A package is code and supporting information bundled for distribution and installation.

A package manager, such as npm or pip, installs and tracks packages for a project.

A dependency is code or software that a project relies on to function.

An external service provides a capability from remote systems operated by another team or company.

Modern software ships quickly because teams build on existing layers rather than creating every capability from the beginning. That speed comes with an ongoing responsibility to understand, update, and protect the components on which the product depends.