241–250 of 520 posts
So they didn't learn anything from left-pad situation from 1.5 year ago? Packages that are published should be immutable, just like in maven repo case.
Stupid question from non-pro here: everyone's always like "never commit libraries into source control." But, um, this kinda thing?
Don't store libraries in your project's repository. It bloats things like hell and makes it difficult to navigate the change sets. Set up your own library cache. Store that cache in its own repo if that floats your boat. Then all of your projects can get their dependencies from your cache.
Just commit them, don't make things a mess.
Earlier quoted context omitted.
It badfles me that technologists commonly complain about new technology. As far as I can tell your complaint boils down to “people should stop making and switching to new things”.. I find it hard to understand why someone with this attitude would be a technologist of any kind, and I find the attitude really obnoxious.
https://xkcd.com/927/
For example it is cool to have multiple tools doing the same thing is cool because you have the choice to use what fits your need (e.g. different Web Servers).
On the other hand, having multiple competing standards for the same job is just technological cancer and mostly the result of some commercial competition (or the attempt to fix a standard by replacing it).
NPM already allows using git repos, but needs some tweaks to allow better support:
* allow versioning via git tags
* store git commit in `package-lock.json`.
* maybe something else...
Earlier quoted context omitted.
yarn is one of those things coming out of the JS world that is actually really well made. yarn, typescript, react; say what you want about js fatigue, these are rock-solid, well-tested projects that are really good at what they do. A major reason for the high toolchurn in that ecosystem is how many of those tools are not designed from the ground up, don't quite solve the things they ought to, or solve them in really…
> yarn, typescript, react; say what you want about js fatigue, these are rock-solid, well-tested projects that are really good at what they do. I wish webpack was on that list.
Webpack though I'm really not sure should be. It's certainly improving, but it's nowhere near the same league as the other ones.
Edit: Ah, I see what you meant :)
Earlier quoted context omitted.
To be completely fair, it isn't exactly drop-in. There's new commands for a bunch of things, mainly around adding new packages locally and globally. I led the yarn switch effort on my direct team and had people coming to me weeks after asking how to do X because of the different commands.
I suspected that someone would mention this, but the fact of the matter is both systems are mostly interoperable. The switch from npm to yarn would be nothing like migrating from Gulp + Browserify to Webpack. To switch to yarn, I printed out a one-page cheat sheet and taped it to my wall. I’ve had one blunder in the time I’ve used it (misunderstanding what `yarn upgrade` did x_x), but it was easily reverted.
Even in this relatively close case, it's not a zero-overhead transition. There are some changes. There are some new behaviours. You still need to know which things really work exactly the same and where the differences come from even if those differences are only minor. You always need due diligence about whether a new tool is reliable, future-proof, trustworthy, etc. And that's all after finding out about the new tool and deciding this one is actually worth looking into.
Multiply all of that by the absurd degree of over-dependence and over-engineering in the JS ecosystem, and it's entirely fair to question whether the constant nagging overheads are worthwhile.
Earlier quoted context omitted.
maybe it's time to push for adding signed packages to npm long discussion here: https://github.com/node-forward/discussions/issues/29
I am very surprised that a package manager of this calibre and impact abstains from best practices when it comes to authentication through code-signing. Other package managers are miles ahead of NPM. For example, Nix, which uses immutability and hashing to always produce the same artifact, regardless of changes of the sources.
There are over 700 comments on this issue on GitHub. It is turning into live chat room. https://github.com/npm/registry/issues/255 Be part of the history :) EDIT: there are now over 1100 comments/memes.
Earlier quoted context omitted.
> yarn, typescript, react; say what you want about js fatigue, these are rock-solid, well-tested projects that are really good at what they do. I wish webpack was on that list.
I mean, there's plenty more that could be on that list, it's not exhaustive. Webpack though I'm really not sure should be. It's certainly improving, but it's nowhere near the same league as the other ones. Edit: Ah, I see what you meant :)