Ride down into JavaScript dependency hell
blog.appsignal.com
Ride down into JavaScript dependency hell
1–10 of 149 posts
Re: Ride down into JavaScript dependency hell
#2I'm not buying the narrative of "js dependency hell what are they thinking" anymore.
Try installing a package for Rust. Or Go. Or ... any language, really.
Re: Ride down into JavaScript dependency hell
#3express (common web framework) seems to have only 51 deps in lockfile
jekyll has 13
I don't disagree that lots of deps = supply chain risk
But there have always been variations between projects & kinds of projects re how many deps they pull in. Try following someone's ipython data science tutorial, it's requirements.txt for days
I think lack of a standard lib early on plus hipster functional culture made the '10s JS leaders like small monofunctional libs.
Focus on transpilation plus lack of tree-shaking in early versions of webpack may have also created an incentive for small things.
Re: Ride down into JavaScript dependency hell
#4So what does NPM do differently than plugin managers from other languages? I can't name one where the dependency hell is this big.
Re: Ride down into JavaScript dependency hell
#5[deleted]
Re: Ride down into JavaScript dependency hell
#6I'm not buying the narrative of "js dependency hell what are they thinking" anymore. Try installing a package for Rust. Or Go. Or ... any language, really.
I’m not sure whataboutism is the way to fix the well-known issues the JS ecosystem has in package management. When I’ve installed a Go package or Python package I haven’t ended up with sometimes hundreds or thousands of sub-dependencies. Some packages can be ridiculous, but nothing like I have seen running “npm i” for something that seems like it should be simple. I apologize for not having an example off-hand but this keeps coming up precisely because it is an issue unique to JS in this case, even if other languages have it to a degree.
Re: Ride down into JavaScript dependency hell
#7JavaScript is what happens when you lock toddlers in a room on their own for a month.
Re: Ride down into JavaScript dependency hell
#8I'm not buying the narrative of "js dependency hell what are they thinking" anymore. Try installing a package for Rust. Or Go. Or ... any language, really.
Gatsby has 19k dependencies. I don't think I can find something like that for Rust.
The largest, and not exactly admirable, I can find is reqwest that drags in 97.
Whilst 100 is a huge number... It's an enormous gap from the many thousands.
Re: Ride down into JavaScript dependency hell
#9I'm not buying the narrative of "js dependency hell what are they thinking" anymore. Try installing a package for Rust. Or Go. Or ... any language, really.
I’m not sure whataboutism is the way to fix the well-known issues the JS ecosystem has in package management. When I’ve installed a Go package or Python package I haven’t ended up with sometimes hundreds or thousands of sub-dependencies. Some packages can be ridiculous, but nothing like I have seen running “npm i” for something that seems like it should be simple. I apologize for not having an example off-hand but th…
Try Feathers, a "lightweight web-framework for creating real-time applications and REST APIs" clocking in at about 600 transitive dependencies. How do you audit this?
Re: Ride down into JavaScript dependency hell
#10So what does NPM do differently than plugin managers from other languages? I can't name one where the dependency hell is this big.
My personal take having “grown up” with all of this - JS is one of the worst ecosystems for relying on external packages for everything. It’s more the culture than the tooling.
One of the things I love about Go is generally people are a little more forgiving to copying something around a couple times instead of making a lib for everything.