Building the Dependency Tree

Given a root package's dependencies, you recursively expand:

my-app
├── express ^4.18.0
│   ├── body-parser ^1.20.0
│   │   └── debug ^4.0.0
│   └── debug ^4.0.0
├── mongoose ^7.0.0
│   └── debug ^4.0.0

Three things to notice:

1. Same package, multiple paths: debug appears 3 times in the tree. In JS land (npm v3+), shared deps get deduplicated at install time — the SAME copy of debug-4.x.x is shared.

2. Conflicts at the same name: if mongoose wanted debug ^3.0.0 and body-parser wanted debug ^4.0.0, you'd have a conflict. Some package managers (npm) allow MULTIPLE COPIES of the same package at different versions in node_modules. Others (Maven) refuse and require manual resolution.

3. Cycles: A depends on B and B depends on A is rare but happens. Most resolvers tolerate it via "already visiting" checks, but installation order becomes ambiguous.

For this lesson: recursive expansion with cycle detection.