Live data from Hacker News

You may not need a bundler for your NPM library

cmdcolin.github.io

11–20 of 40 posts

Re: You may not need a bundler for your NPM library

#11

- bundles let you ship less code (tree shaking) - dependency versions being fixed is a feature. I've had package installs fail because a dependency published a semver-compatible update that broke something. In a web context this would break the app until the dependency pulled the update or the dependent pushed an update disallowing that version.

> - bundles let you ship less code (tree shaking)

bundling should be done as a step to build an application. it's really not needed when you prepare a library.

> - dependency versions being fixed is a feature. I've had package installs fail because a dependency published a semver-compatible update that broke something.

If this is the case please open a bug to the dependency team. And then avoid ^ ~ and * in the dependencies version you are using.

Re: You may not need a bundler for your NPM library

#12
post #3

Nice write up. It still boggles the mind when coming from a Java background how things change but also get worse. Having zip's (.jar/.war) which had the source and compiled artefacts available and not cluttering the OS with unzip items. I've run into huge issues dealing with deployments to AWS Lambda nodejs, where the previous developer could not work out how to make a 'slip' deployment and just zipped the whole fold…

yeah that's the biggest issue with node/npm. 90% of your code lives on the registry, and you probably not even sure what 99% of it actually does.

would be nice if you could somehow reverse the compilation of your build back into a source folder, instead of having node_modules - but i think that's probably not possible.

Re: You may not need a bundler for your NPM library

#13
post #3

Nice write up. It still boggles the mind when coming from a Java background how things change but also get worse. Having zip's (.jar/.war) which had the source and compiled artefacts available and not cluttering the OS with unzip items. I've run into huge issues dealing with deployments to AWS Lambda nodejs, where the previous developer could not work out how to make a 'slip' deployment and just zipped the whole fold…

yeah that's the biggest issue with node/npm. 90% of your code lives on the registry, and you probably not even sure what 99% of it actually does. would be nice if you could somehow reverse the compilation of your build back into a source folder, instead of having node_modules - but i think that's probably not possible.

Isn't that exactly what bundling does?

Re: You may not need a bundler for your NPM library

#14
post #13

Earlier quoted context omitted.

yeah that's the biggest issue with node/npm. 90% of your code lives on the registry, and you probably not even sure what 99% of it actually does. would be nice if you could somehow reverse the compilation of your build back into a source folder, instead of having node_modules - but i think that's probably not possible.

Isn't that exactly what bundling does?

i think bundling generates your build from the source, but i mean generating a source from a build. so what i mean is more like reverse bundling.

so that you don't have to pull node_modules every time and install. i;m not totally sure but i dont think you can turn a minified bundled js files back into their original node_module source files...

Re: You may not need a bundler for your NPM library

#15
post #3

Nice write up. It still boggles the mind when coming from a Java background how things change but also get worse. Having zip's (.jar/.war) which had the source and compiled artefacts available and not cluttering the OS with unzip items. I've run into huge issues dealing with deployments to AWS Lambda nodejs, where the previous developer could not work out how to make a 'slip' deployment and just zipped the whole fold…

> just zipped the whole folder node_modules and all and shipped that

I mean, in a sense, something similar is what you should do if you're aiming for maximum reproducibility, of course, excluding the things that you don't need.

For a comparison, if you wanted to build a Docker container, it's going to include the node_modules folder in it, instead of installing dependencies on startup. So, in a word, somewhat similar to a fat .jar file (e.g. that has all dependencies, vs assuming that the app server will provide some).

My problem is that sometimes it's not awfully clear how to exclude all of the stuff that you don't need.

For example, my homepage is made with Ruby on Rails, for which I have a basic container image. But to actually bundle all of the resources, I do need Python, Node (with Yarn in my case) and also a bunch of gems, so I also make a separate dev container image.

I can install all of the dependencies I need for packaging and run them in a multi-stage image, carrying over the packaged files to something based on the basic image for just running it (e.g. without Python and Node), but I still need the gems to be present and there's no obvious way to carry over only the ones I need for running a Rails app.

Even without containers, this very same pain is present in many tech stacks, even if you wanted to run software directly on the servers to which you deploy it - many stacks out there aren't really big on fully self-contained executable packages (or even ones that depend on a particular version of a runtime, like JVM or .NET, but have everything else included).

Ergo, working with Ruby, Python, Node and many others can be a bit more troublesome than it should be. Personally, containers alleviate some of those problems to a degree, at the expense of exposing that complexity to you during build time.

Re: You may not need a bundler for your NPM library

#16
Huh, is bundling commonly found in library npm packages? Which packages do this? Asking so I can avoid this.

I already have a bundle intended for distribution to web browsers, I don't need these sorts of poor practices introducing unnecessary bundling code. Nested bundling sounds like insanity to me. So I very much agree with the author that this practice never made sense in the first place, and I'm baffled that it exists. It's very much an npm anti-pattern.

Re: You may not need a bundler for your NPM library

#17
post #6

Completely agree, ship it using tsc and in pure esm. Its time to move on from CJS

And ship a commonjs version as well, if you need to support older node versions. It's trivial.

It’s actually pretty annoying that some people are now going pure esm and actively removing cjs builds. There are certain libraries that don’t work with esm yet, so if you need one of those suddenly all the esm-only packages can’t be used.

Re: You may not need a bundler for your NPM library

#18

> If you are bundling dependencies, you are not allowing people to get updates to your sub-dependencies with semver! That's a reason for bundling.

So... set ourselves up for another Log4j situation where a vulnerability is found in a sub-sub-sub dependency of some dependency you didn't even know you were using, such that only good way of fixing it is to manually scrub the code from `.jar`s?

Re: You may not need a bundler for your NPM library

#19

> If you are bundling dependencies, you are not allowing people to get updates to your sub-dependencies with semver! That's a reason for bundling.

You missed the point of Node’s dependency resolution.

If you want to lock the dependencies, just use a lockfile in your app, you don't need to ship the same code 10 times because your dependencies already decided to bundle their sub-dependencies.

Re: You may not need a bundler for your NPM library

#20
post #10

> If you are bundling dependencies, you are not allowing people to get updates to your sub-dependencies with semver! That's a reason for bundling.

if you want to work with a vendored copy of a dependency, do it clearly; copy the sources in src and remove the dependency from the package.json

For what? If you want to alter it, yes, otherwise package.json already has `bundledDependencies` to achieve the same without cluttering your repository.
Post reply on HN