Every project does two things before it can run: pull in third-party code (dependency resolution) and turn source files into a shippable artifact (compilation, bundling, packaging). Some ecosystems split the two; others fuse them. The names change per stack, but the concepts repeat — manifest file, lockfile, dependency graph, build cache, artifact.
← Back to Cross-Cutting Toolspackage.json, pom.xml, pyproject.toml, Cargo.toml).package-lock.json, poetry.lock, Cargo.lock). Commit this. Without it, "works on my machine" is unavoidable.Maven is XML-based, opinionated, predictable. pom.xml declares dependencies; the lifecycle (compile, test, package, install) is fixed. Boring, in the good sense.
Gradle is Groovy/Kotlin DSL, faster (incremental builds, build cache, daemon), more flexible. The flexibility cuts both ways — Gradle scripts can become a maintenance burden if you let them.
Repos: Maven Central is canonical. Verify checksums; the supply chain has been attacked.
Two layers: install the deps and bundle the browser code.
One unified CLI: dotnet restore / build / test / publish / pack. NuGet is the package manager (and registry, nuget.org). MSBuild is the underlying build engine — XML-based .csproj files driving compilation. SDK-style projects are now the norm and are pleasantly terse.
pip + requirements.txt is the lowest common denominator; no real lockfile, no environment management. Poetry introduced pyproject.toml-based projects with a real lockfile. uv (Astral, Rust-based) is the new fast option — orders of magnitude faster than pip and increasingly the default in new projects. pipenv still exists but momentum has moved on.
Virtual environments isolate per-project deps; without one you fight system Python forever.
The hardest ecosystem. Make is unix-classic, brittle, still everywhere. CMake generates Make/Ninja/MSBuild files — the cross-platform default for modern C++. Bazel (Google) does monorepo-scale hermetic builds. Package management is the long-suffering part — Conan and vcpkg finally make it tolerable.
Go modules + go build produce a single static binary. No external package manager needed.
Cargo is the bar for what a build tool should feel like: cargo build / test / publish, hermetic dependency resolution, integrated docs, all-in-one.
Android uses Gradle with the Android Gradle Plugin. iOS used CocoaPods for years; Swift Package Manager (SPM) is now the official Apple direction and ships with Xcode.
For monorepos that span languages, dedicated meta-build systems pay off: parallel builds, hermetic outputs, remote caching, only-rebuild-what-changed. Bazel and Buck2 are language-agnostic and rigorous; Nx and Turborepo sit on top of npm/pnpm for JS-heavy monorepos.
pip-audit, npm audit, cargo audit, GitHub Advanced Security), and disable post-install for untrusted packages where you can.^, ~, latest — fine for libraries' manifests, never for the lockfile that ships.