Can students install packages themselves?

On any task with a package file, if the task allows them to change it. They add the package to the file as they would on their own computer, and the next run installs it.

Can a program download packages while it runs?

No. The run has no network; packages are fetched beforehand, in a separate container, from the approved list.

Why must every version be exact?

So that every student in the class, and the marking, runs against the same packages. A range would install whatever was newest that day.

Use a real pom.xml, requirements.txt, package.json or go.mod in a coding task

A student who learns with a real requirements.txt, pom.xml or package.json learns the thing they will meet in every job and every open-source project. So a coding task here declares its packages exactly that way: in the file the language’s own tools read, at the top of the task’s file tree, and nothing else to fill in.

The same file works on a student’s own computer, so a project copied out of the platform, or loaded into it from Git, keeps working without anybody rewriting its packages into a form of ours.

Which file, for which language

Python reads requirements.txt or pyproject.toml, and a notebook reads requirements.txt. Java reads pom.xml. Go reads go.mod. JavaScript and TypeScript on Node read package.json. The file sits at the top of the tree marked Packages, and a new task opens with a small worked example in it to replace.

Bash, SQL, C, C++, C#, Haskell, OCaml, R, Ruby, PHP, Rust, Kotlin and Prolog have no package file: their runs have no network for a package manager to reach, and what they need is already installed.

Open the task in its editor. The package file is at the top of the file tree, marked Packages.
Name the packages. Write them as you would on your own computer, each with its exact version. A range such as >=2.0 or ^4.18 is refused, because a version that changes between runs is not one anybody can mark against.
Or bring in the file you already have. Upload it at the top of the tree, or make a file of that name there, and it becomes the task’s package list.
Press Run. The packages are installed before the program starts. The first run takes longer; later runs reuse what was fetched.

How the packages are installed

Packages are fetched in a separate container and handed to the run read-only, and the run itself has no network. A student’s program therefore cannot download anything while it runs, and a task that declares the same packages as another reuses what was already fetched.

Each language’s packages come from an approved list of widely used ones, matched the way that ecosystem names things: Python and npm packages by name, Java by the publisher’s group and Go by module path. A package that is not on it is refused before anything runs, and the message names it. If your course needs one that is missing, ask through Support.

A package file may be up to 64 KB, the same as any other file in the task. Lock files such as package-lock.json or poetry.lock are not read: the exact versions in the package file are what is installed.

Java and Maven

A pom.xml is read the way Maven reads it for its dependencies: properties, dependency management, a parent pom and BOM imports, and scopes, a test-scoped package such as JUnit being there for the tests only. Packages come from Maven Central. A Gradle build file is not read; use a pom.xml.

A Java task made before pom.xml was supported keeps its older dependencies.xml, which still works. To move it to a pom, paste a whole pom.xml into it or rename it to pom.xml.

Python, Node and Go

A Python task has one package file at a time, so to switch from requirements.txt to pyproject.toml, rename the file. A pyproject.toml is read for its [project] dependencies or Poetry’s dependencies table.

A package.json is read for its dependencies, and for its devDependencies as well when the tests run, which is where a JavaScript project keeps what only its tests import. Install scripts are never run.

A go.mod is read for its requirements, and for a replace that points a module at a folder of the project itself, so a task can be a Go module with packages of its own.

Who may change the list

Students always see the package file, because reading it is part of understanding the project. Whether they can change it is a setting on the task: allowed, a student adds a package to their own copy as they would on their own computer, and the next run installs it.

Questions people ask

Can students install packages themselves?: On any task with a package file, if the task allows them to change it. They add the package to the file as they would on their own computer, and the next run installs it.
Can a program download packages while it runs?: No. The run has no network; packages are fetched beforehand, in a separate container, from the approved list.
Does it support Gradle?: No. Java tasks read a pom.xml.
Why must every version be exact?: So that every student in the class, and the marking, runs against the same packages. A range would install whatever was newest that day.