5.4 Dependency and Build Tool Quick Reference

Type: Reference page, no required sequential reading

Scope: Python/pip, npm, Maven, and Gradle; specific versions depend on the project's Wrapper and CI setup

This page is for locating commands and does not replace the project's own README or Wrapper.

Ecosystem Comparison

Ecosystem	Manifest	Lock/Lock Status	Project-Level Entry	Dependency Check
Python/pip	pyproject.toml, requirements input	Generated by the selected tool	python -m pip	pip inspect, pip check
npm	package.json	package-lock.json	npm run, npm ci	npm ls, npm explain
Maven	pom.xml	No default full lock	./mvnw	dependency:tree, help:effective-pom
Gradle	build.gradle(.kts)	Optional gradle.lockfile	./gradlew	dependencies, dependencyInsight

Maven and Gradle

Goal	Maven	Gradle
Clean verification	./mvnw clean verify	./gradlew clean check
Packaging	./mvnw package	./gradlew build
Dependency tree	./mvnw dependency:tree	./gradlew dependencies
Single source	dependency:tree -Dincludes=GROUP:NAME	dependencyInsight --dependency NAME --configuration runtimeClasspath
Tool version	./mvnw --version	./gradlew --version

Maven's build lifecycle is a sequence of phases; Gradle's build is a task graph. Gradle can execute appropriate tasks in parallel or incrementally, and Maven also has parallel build options. You cannot generalize the real performance as "one sequential, one parallel."

Installation and Rebuilding

# Python: activate the virtual environment first
python -m pip install -r requirements.txt
python -m pip check

# npm: the lockfile must match the manifest
npm ci
npm ls --all

# Maven / Gradle
./mvnw clean verify
./gradlew clean build

Choose the command group for your project after checking that its manifests, Wrapper, and tools exist; these four groups are not a single script. npm ci first removes an existing node_modules directory and runs applicable lifecycle scripts by default.

These commands may contact the repositories configured by the project. Maven -o, Gradle --offline, and npm --offline will fail when local artifacts or caches are missing. Offline installation of pip requires preparing a local wheel or source directory, such as python -m pip install --no-index --find-links=./wheelhouse -r requirements.txt; --no-index itself does not turn caches into complete software sources.

Git Tips

Commit manifests, lockfiles or lock state, wrappers, and required shared configuration. Ignore .venv/, node_modules/, target/, .gradle/, and build/. IDE directories are handled according to team-level rules.

Official Verification Entry

• npm install and npm ci explain the differences in constraints between lock files, dependency lists, and automated installation.
• Python Dependency Specifications and pylock.toml respectively define dependency expressions and the standard lock file format.
• Maven Dependency Mechanism explains transitive dependencies, scope, BOM, and dependencyManagement.
• Gradle Dependency Locking explains when lock states are generated and how they should be submitted.

→ Open Comprehensive Experiment