Lately I’ve been hopping between projects that use different Rust, Python, and TypeScript package managers, and I kept having to turn back to documentation to keep their subcommands straight when switching from one back to another. So I made this cheat sheet for my own reference, and I might as well share it with the class too…
Project dependencies
Common package management tasks include:
- Prepare clone, or ensure the dependencies needed to work with the project are installed, such as after newly cloning the project’s sources.
- Audit checks the current dependency versions against a public database for known security vulnerabilities.
- Any outdated checks whether any dependencies have newer versions currently available, among either direct or indirect dependencies.
- Compatible outdated checks specifically for newer available versions that are compatible with the project’s dependency specification.
- Add adds a new regular dependency to the project, and add dev adds a new development-only dependency. This step includes locking the dependency.
- Update brings an application’s locked packages up-to-date with the latest compatible version.
In the package managers I’ve been using lately, these look like:
| cargo | uv | pip-tools [1] | pnpm | |
|---|---|---|---|---|
| Prepare clone | N/A | uv sync (optional) | pip-sync dev-requirements.txt | pnpm install |
| Audit | cargo audit [2] | uv run pip-audit | pip-audit | pnpm audit |
| Any outdated | cargo outdated [3] | uv tree --outdated | pip list --outdated [4] | pnpm outdated |
| Compatible outdated | cargo update -n | uv lock -Un | pip-compile -Un | pnpm outdated --compatible |
| What requires | cargo tree --invert | uv tree --invert --package | pipdeptree -r -p | pnpm why |
| Add | cargo add | uv add | Manually add to pyproject.toml, then run pip-compile | pnpm add |
| Add dev | cargo add --dev | uv add --dev | Add and run pip-compile | pnpm add --save-dev |
| Update | cargo update | uv lock -U | pip-compile -U | pnpm update |
