# Dependencies > miso install, add, remove, list, lock, update, vendor and cabal; where packages come from, and miso.lock. Source: https://haskell-miso.org/docs/cli-dependencies/ The dependencies of a project are the `dependencies:` of its `miso.yml`: Hackage packages, `git:` checkouts and local `path:`s. miso installs them in the project, and locks them in `miso.lock`. ## Where packages come from Some packages come with the tool: the compiler's (`base`, `ghc-compat`, `array-mhs`, `template-haskell`) and the libraries `containers`, `mtl` and `transformers`. The rest are installed in the project's `.miso/`, so two projects can use two versions of a package. miso itself is a dependency like any other: `miso new` writes `dependencies: [miso]`, which is the miso the release was built from, installed prebuilt. Another miso is a dependency with its own source: ``` dependencies: - name: miso git: https://github.com/dmjio/miso rev: master ``` A project can replace one of the tool's libraries too (with `git:`, `path:`, or a `version:` that is not the tool's); the tool's libraries that need it are built again against it. The compiler's packages cannot be replaced. Building a package takes time, so each one is kept in a store, `~/.miso/store`, and a project that needs the same one again (same source, flags, compiler, and packages it was built against) copies it from there. ## miso.lock `miso lock` and `miso update` write `miso.lock` next to `miso.yml`; commit it. It has every package the project needs, in install order: for a Hackage package a version and the sha256 of its tarball, for a git dependency the commit its `rev` is at. - The versions are those of mcabal's package list (a Stackage snapshot); a package that is not in it gets Hackage's newest version. - The version ranges of `build-depends` are checked: a package gets a version that the packages that need it take, and a version that one does not take is an error before anything is built, saying which package needs what. When a package read later needs an older version of one chosen before, `miso lock` resolves again with the ranges it found. - Builds install exactly what `miso.lock` says, each Hackage tarball checked against its sha256. ### miso install ``` miso install ``` Installs the dependencies of `miso.yml` in the project's `.miso/`, each after the packages it needs: with `miso.lock`, exactly what it locks; without one, locked for this install as `miso lock` would (without writing it); in a vendored project, from `vendor/`. Builds run it first, so it is rarely needed by hand. ### miso add ``` miso add PKG... ``` Adds Hackage packages to the `dependencies:` of `miso.yml` (keeping its comments and layout), and installs them. When the install fails, `miso.yml` is written back as it was. For `git:`, `path:` or a `version:`, edit `miso.yml`. ### miso remove ``` miso remove PKG... ``` Removes dependencies from `miso.yml`. Their packages stay installed in `.miso/` until `miso clean`. ### miso list ``` miso list ``` Lists the packages that come with the tool, and in a project, the packages installed in its `.miso/` (marked when they replace one of the tool's). ### miso lock ``` miso lock ``` Writes `miso.lock`: it locks what is not locked yet (a new dependency, one whose `git` or `rev` changed, or a package a new one needs), keeps what is, and drops what is no longer needed. It lists the changes, or says `miso.lock is up to date`. ### miso update ``` miso update ``` Gets a new package list (the newest Stackage snapshot), locks every package again at its version and every git dependency at the current commit of its `rev`, writes `miso.lock`, and installs. ### miso vendor ``` miso vendor ``` Runs `miso lock`, then copies the source of every locked package to `vendor/NAME`. Builds then install from `vendor/` and never download: commit it for builds that work offline. ### miso cabal ``` miso cabal ``` Prints the `.cabal` file of the project's `library:`: what another project that depends on this one (with `git:` or `path:`) builds it with.