Commonly Asked Questions
What happens if two packages depend on the same package?
Forest PM uses a technique called “dependency de-duplication” to ensure that if multiple packages depend on the same package, only one copy of that package is installed. This helps to reduce disk space usage and avoid version conflicts.
What if two packages depend on different versions of the same package?
That depends on the platform (see conflict resolution for the full rules):
On Roblox, Forest installs both versions in separate folders within the Packages directory. Each package uses the version it was designed to work with, preventing compatibility issues, at the cost of some duplicate code. Prefer packages that depend on compatible versions of shared dependencies when you can.
On UEFN, a project resolves every package to a single version (Verse module paths carry no version), so a genuinely incompatible conflict is a hard error naming both requesters. Align the ranges or drop one.
What happens if I install 2 packages with the same name?
If you attempt to install two packages with the same name but from different authors or sources, Forest PM will treat them as separate entities based on their full package identifiers (which typically include the author’s namespace).
This means you can have user1/package and user2/package installed simultaneously without conflict, as they are considered distinct packages.
On Roblox, both would default to the same folder name, so install the second one under an alias (on UEFN no alias is needed: imports are already namespaced by scope, see Scopes & Collisions):
forest i user1/package
forest i user2/package -a package2Then require each by its folder name:
local Package1 = require(Packages.package)
local Package2 = require(Packages.package2)Do private packages cost money?
Not necessarily. Every account and every Studio includes up to 10 private packages on the free plan. Pro users and Pro Studios get unlimited private packages. See Private Packages.
Are private packages hidden from my game’s players?
No, and that’s a common misunderstanding worth being precise about. Private controls who can download the package from the registry (other developers can’t see or install it). It does not control runtime visibility: on Roblox, for example, if the consuming game mounts its packages tree under ReplicatedStorage, the private package’s code replicates to clients like anything else there. To keep server-only packages off clients, mount them in a server-only location using the two-manifest pattern. See Private Packages.
Are circular dependencies allowed?
They aren’t rejected at publish or install time, and installation handles them without issue, but because you can only depend on already-published versions, a cycle can only be formed retroactively across versions, and it’s almost always a sign that two packages should be one. See Dependencies & Versioning.
How do I update my dependencies to newer versions?
Run forest update to move everything to the newest versions your declared ranges allow (the safe, routine refresh). To go further, forest audit shows which dependencies have newer versions beyond your ranges (and any license considerations), and forest audit --update bumps them all to the latest and reinstalls. The CLI updates itself with forest upgrade. See Updating dependencies.
What does the “Mirrored” badge on a package mean?
The package was imported from Wally , another community package manager. The source is unmodified, only open-source-licensed versions are imported, and the author’s scope is reserved for them to claim. Install and depend on it like any other package. See Mirrored Packages.