Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Npm v5.0.0 released

blog.npmjs.org

Post reply on HN
Print view View original

31–40 of 117 posts

Re: Npm v5.0.0 released

#31

Post by bryanlarsen »

nailer wrote: post #22
chrisweekly wrote: post #10

First of all: Thank you, yarn, for helping the community see the naked emperor. Deterministic builds by default are such an obvious (in retrospect) core requirement. Couple questions: Question 1: Does anyone else who's been around more than a couple years share my view that Yarn : NPM :: IO.JS : Node? IOW: healthy competition, catalyst for necessary change, ultimately a bridge or stopgap. Question 2: Any good compreh…

> Thank you, yarn, for helping the community see the naked emperor. Deterministic builds by default are such an obvious (in retrospect) core requirement. https://docs.npmjs.com/cli/shrinkwrap provides deterministic builds and has been around far longer than yarn. Since Oct 2014 npm v3 started automatically updating shrinkwrap whenever '--save' was used. See https://github.com/npm/npm/pull/4918#issuecomment-61344871 C…

Even with shrinkwrap, npm install is not deterministic, install order still matters. To get a deterministic install, you need to use shrinkwrap and do an `rm -rf node_modules` before every install. And it's still not completely deterministic if any dependency or sub-dependency has optionalDependencies.

https://docs.npmjs.com/how-npm-works/npm3-nondet

Re: Npm v5.0.0 released

#32

Post by tiles »

pluma wrote: post #16
chrisweekly wrote: post #10

First of all: Thank you, yarn, for helping the community see the naked emperor. Deterministic builds by default are such an obvious (in retrospect) core requirement. Couple questions: Question 1: Does anyone else who's been around more than a couple years share my view that Yarn : NPM :: IO.JS : Node? IOW: healthy competition, catalyst for necessary change, ultimately a bridge or stopgap. Question 2: Any good compreh…

When io.js merged back into node.js the following happened: 1. Node.js was abandoned and replaced with io.js. 2. Io.js was relabelled as node.js. 3. The node.js project was put under open governance via the creation of the Node Foundation. This doesn't really compare to npm: * The npm-cli's name is using npm Inc's trademark: giving it away would leave the company with no name or create unwanted ambiguity between npm…

What replaces the npm registry, though? That's the reason that npm Inc. exists, not just stewardship of the CLI.

Re: Npm v5.0.0 released

#33

Post by nailer »

bryanlarsen wrote: post #31
nailer wrote: post #22

Earlier quoted context omitted.

> Thank you, yarn, for helping the community see the naked emperor. Deterministic builds by default are such an obvious (in retrospect) core requirement. https://docs.npmjs.com/cli/shrinkwrap provides deterministic builds and has been around far longer than yarn. Since Oct 2014 npm v3 started automatically updating shrinkwrap whenever '--save' was used. See https://github.com/npm/npm/pull/4918#issuecomment-61344871 C…

Even with shrinkwrap, npm install is not deterministic, install order still matters. To get a deterministic install, you need to use shrinkwrap and do an `rm -rf node_modules` before every install. And it's still not completely deterministic if any dependency or sub-dependency has optionalDependencies. https://docs.npmjs.com/how-npm-works/npm3-nondet

I've read the https://docs.npmjs.com/how-npm-works/npm3-nondet but it make no mention of shrinkwrap. Since shrinkwrap captures versions for the entire tree, install order wouldn't matter.

Re: Npm v5.0.0 released

#34

Post by Silhouette »

nailer wrote: post #22
chrisweekly wrote: post #10

First of all: Thank you, yarn, for helping the community see the naked emperor. Deterministic builds by default are such an obvious (in retrospect) core requirement. Couple questions: Question 1: Does anyone else who's been around more than a couple years share my view that Yarn : NPM :: IO.JS : Node? IOW: healthy competition, catalyst for necessary change, ultimately a bridge or stopgap. Question 2: Any good compreh…

> Thank you, yarn, for helping the community see the naked emperor. Deterministic builds by default are such an obvious (in retrospect) core requirement. https://docs.npmjs.com/cli/shrinkwrap provides deterministic builds and has been around far longer than yarn. Since Oct 2014 npm v3 started automatically updating shrinkwrap whenever '--save' was used. See https://github.com/npm/npm/pull/4918#issuecomment-61344871 C…

Shrinkwrap is a partially successful attempt to solve the problem, but still has obvious flaws. For example, instead of the relatively neat version specifications normally used in package.json, with a shrinkwrapped project you wind up with https://registry.npmjs.org/... paths instead, but only sometimes. This gets messy if you want to both install stable versions of all your packages and use a local registry to supply them for reliability, which is not an unlikely combination.

Re: Npm v5.0.0 released

#35

Post by KayL »

eknkc wrote: post #6

Just tried on a couple of projects with a lot of dependencies, we moved to yarn a while ago due to performance issues and it seems to be resolved. On cold cache: Yarn: 20.94 seconds NPM5: 21.11 seconds With cache: Yarn: 10.35 seconds NPM5: 15.20 seconds For some reason, when node_modules folder is still there, yarn exits in a couple hundres milliseconds but npm5 does something for around 5 seconds. Haven't checked lo…

my test:

npm@5 28.274s vs 11.60s Yarn

@Windows10, SSD, warn cache

Re: Npm v5.0.0 released

#36

Post by tiles »

vacri wrote: post #29

How is the package manager for a language still iterating through major versions and making breaking changes nearly a decade after launch? Node is bizarre in that you have to follow its package manager so closely.

npm has to deal with scale: it's now the largest programming language package manager, and most project dependency trees have exploded in size as a result. Optimizing that led to yarn and to npm@5.

Re: Npm v5.0.0 released

#37

Post by k__ »

nailer wrote: post #24
k__ wrote: post #15

Someone told they now use hashes for versioning, like Nix, is this true? Is it finally save to install 2 times and get 100% the same packages?

It's been that way for years, since shrinkwrap was invented.

Really? Does shrinkwrap work for transitive deps?

Re: Npm v5.0.0 released

#38

Post by vmasto »

gear54rus wrote: post #30
Achshar wrote: post #9

So happy with the --save by default. Someone at work kept installing new dependencies without save (they didn't knew about it, somehow). We then had an unusable package.json. I had to manually find directories in node_modules and install them on production -_-.

And I think this is a complete bs. I have to try the module and then make a conscious decision to use (save) it, not kind of save it first and then hope that it actually does what I want. Like wtf, who thought that saving something you download maybe for the first time as a dependency is a good idea?

It is perfectly reasonable and avoids mistakes. It's better to have a module that's unused than to break your whole build.

If you want to try something install it and then remove it. That's the more conscious decision. I don't want to have to remember to save the module if I end up liking it, but I will remember to remove it when tearing it down from the codebase, and if I don't, nothing bad happens.

Re: Npm v5.0.0 released

#40

Post by jbverschoor »

tiles wrote: post #36
vacri wrote: post #29

How is the package manager for a language still iterating through major versions and making breaking changes nearly a decade after launch? Node is bizarre in that you have to follow its package manager so closely.

npm has to deal with scale: it's now the largest programming language package manager, and most project dependency trees have exploded in size as a result. Optimizing that led to yarn and to npm@5.

npm has to deal with scale because every single npm install goes to npm instead of a local cache of certain versions.

Bundler led to yarn. The JS community should start looking what other ecosystems do and have done (right and wrong).

Such a waste of time these past 20 years and it happens over and over.

Post reply on HN