pnpm: Fast, disk space efficient package manager for JavaScript • Hacker News Board

Re: pnpm: Fast, disk space efficient package manager for JavaScript

#171

Post by 5e92cb50239222b » Thu, Apr 07, 2022, 1:43 PM UTC

trulyme wrote: post #74

5e92cb50239222b wrote: post #67

Earlier quoted context omitted.

Containers don't provide much protection from malware, unless you're running it rootless under an unprivileged user (no sudo access, no ssh keys or anything else interesting in the home directory, etc; and even then it's limited because the attack surface is enormous).

I mean, of course? Especially, why would I put ssh keys and similar in the container? This still doesn't mean that one can install just any package, but it does make it much more difficult for it to do much harm. Breaking out of a container is not as trivial as it once was. That said, it is not a perfect solution, so I'd be happy to hear of better ones. Any suggestions?

No ssh keys or anything else interesting available to the user you're running the container engine under (and containers themselves). Not the user _inside_ the container, but on the main system.

Re: pnpm: Fast, disk space efficient package manager for JavaScript

#172

Post by jakubmazanec » Thu, Apr 07, 2022, 3:56 PM UTC

ricardobeat wrote: post #167

jakubmazanec wrote: post #166

Earlier quoted context omitted.

By "autoinstalling peer deps" I don't mean "installing unnecessary deps" - those peer dependencies are required, you still have to install them, I just don't want to manually add them to my package.json.

We’ll, it’s hard to argue with that, we simply have very different expectations. You want NPM to automatically fix what is clearly user error so that installing random plugins “just works”, and don’t care that 3rd+ level deps might end up pulling a hundred extra packages you never asked for; I want it to follow its own dependency management rules to the letter and not have anything installed by surprise. Clearly ther…

Nothing is installed by surprise. Peer dependencies are not optional (you have to specify them as such). There is no user error and there is nothing for npm to fix.

I have some app:

  {
    "name": "some-app",
    "dependencies": {
       "foo": "^1.0.0"
    }
  }

foo specifies some peer dep:

  {
    "name": "foo",
    "peerDependencies": {
       "bar": "^1.0.0"
    }
  }

Now some-app doesn't directly use bar, so I didn't add it to package.json. Npm@7 and newer will install everything: foo and bar. If I used package manager without auto installing peer dependencies, I would have to manually update my package.json:

  {
    "name": "some-app",
    "dependencies": {
       "foo": "^1.0.0",
       "bar": "^1.0.0"
    }
  }

But in both cases node_modules will contain foo and bar. There are no "extra packages you never asked for". Adding bar as dependency of some-app is completely redundant information.

Now, it's possible that there are packages that don't really require some peer dependency installed, and therefore thery are installed needlessly. But that's problem of those poorly developed packages, not mine. Why should I waste time to manually specify what should and should not be installed?

Re: pnpm: Fast, disk space efficient package manager for JavaScript

#173

Post by aabbcc1241 » Tue, Apr 12, 2022, 4:37 PM UTC

brainbag wrote: post #129

aabbcc1241 wrote: post #119

Earlier quoted context omitted.

I have custom bash scripts named npm and yarn, they invoke pnpm for installing and uninstalling packages, and fallback on other commands (e.g. audit). This way work well with other tools (e.g. I can force create-react-app to install packages with pnpm)

There's an npm package "narn" that uses commands akin to yarn's but will automatically use whatever package manager the current folder(/parent) is using. I almost never type npm or yarn or pnpm, just narn everywhere. Really handy.

I added the script to PATH, so other tools that hard-coded to use yarn or npm (e.g. create-react-app) are hijacked to use pnpm when installing packages