Commonly Asked Questions
What happens if two packages depend on the same package?
Forest PM uses a technique called “dependency de-duplication” to ensure that if multiple packages depend on the same package, only one copy of that package is installed. This helps to reduce disk space usage and avoid version conflicts.
What if two packages depend on different versions of the same package?
That depends on the platform (see conflict resolution for the full rules):
On Roblox, Forest installs both versions in separate folders within the Packages directory. Each package uses the version it was designed to work with, preventing compatibility issues, at the cost of some duplicate code. Prefer packages that depend on compatible versions of shared dependencies when you can.
On UEFN, a project resolves every package to a single version (Verse module paths carry no version), so a genuinely incompatible conflict is a hard error naming both requesters. Align the ranges or drop one.
What happens if I install 2 packages with the same name?
If you attempt to install two packages with the same name but from different authors or sources, Forest PM will treat them as separate entities based on their full package identifiers (which typically include the author’s namespace).
This means you can have user1/package and user2/package installed simultaneously without conflict, as they are considered distinct packages.
On Roblox, both would default to the same folder name, so install the second one under an alias (on UEFN no alias is needed: imports are already namespaced by scope, see Scopes & Collisions):
forest i user1/package
forest i user2/package -a package2Then require each by its folder name:
local Package1 = require(Packages.package)
local Package2 = require(Packages.package2)Do private packages cost money?
Not necessarily. Every account and every Studio includes up to 10 private packages on the free plan. Pro users and Pro Studios get unlimited private packages. See Private Packages.
Are private packages hidden from my game’s players?
No, and that’s a common misunderstanding worth being precise about. Private controls who can download the package from the registry (other developers can’t see or install it). It does not control runtime visibility: on Roblox, for example, if the consuming game mounts its packages tree under ReplicatedStorage, the private package’s code replicates to clients like anything else there. To keep server-only packages off clients, put them in their own mount and map that folder in a server-only location such as ServerScriptService. See Private Packages.
Are circular dependencies allowed?
They aren’t rejected at publish or install time, and installation handles them without issue, but because you can only depend on already-published versions, a cycle can only be formed retroactively across versions, and it’s almost always a sign that two packages should be one. See Dependencies & Versioning.
How do I update my dependencies to newer versions?
Run forest update to move everything to the newest versions your declared ranges allow (the safe, routine refresh). To go further, forest audit shows which dependencies have newer versions beyond your ranges (and any license considerations), and forest audit --update bumps them all to the latest and reinstalls. The CLI updates itself with forest upgrade. See Updating dependencies.
What does the “Mirrored” badge on a package mean?
The package was imported from Wally , another community package manager. The source is unmodified, only open-source-licensed versions are imported, and the author’s scope is reserved for them to claim. Install and depend on it like any other package. See Mirrored Packages.
How do I report a package?
Open the package’s page on forest.dev while signed in and click Report this package at the bottom of the details panel. Pick a reason (malicious code, text that tries to instruct AI agents, a license or copyright problem, impersonation, spam, or something else) and describe what you found, with the file and line if you can. The report goes to the Forest team. The package owner is not told who reported it. You can have one open report per package and file up to five reports a day.