Live data from Hacker News

A JavaScript Nightmare

blog.ignaciobrasca.com

11–20 of 101 posts

Re: A JavaScript Nightmare

#11
post #10
post #7

tldr: A dependency wasn't pinned, the dependency changed, and stuff broke. Author thinks Javascript sucks. I will say this though: it is infuriating that package managers (every single one I've used, not just NPM) don't default to pinning exact dependency versions, and instead let it "automatically" update minor versions.

The package wasn't following semantic versioning. Only major versions should introduce breaking changes.

The only change that isn't "breaking" is one that only adds functionality.

Otherwise, it changes behavour, and has the potential to break your software.

In practice, almost all changes should be major version bumps.

Anyway that's besides the point. Let me control when version changes happen!

Re: A JavaScript Nightmare

#12
I didn't quite understand why they had to debug on the spot, thus working like 36 hours uninterrupted or so.

A sane working environment would file a priority 0 bug and address it during working hours.

I'm not throwing a rock but oftentimes this sort of heroic behavior is self-inflected.

Also why is heroic debugging required on something that is not production? The article mentions it was a "quick demo". Then who gives a shit? There's time to investigate. And this would/should NEVER happen to production. The whole point of testing and staging/UAT environment is to catch this sort of problems. Again, a normal day at work in software engineering and not something to kill yourself living on amphetamine like a commando behind enemy lines in WW2.

Re: A JavaScript Nightmare

#15

Shouldn’t you use fixed versions and use something like ‘npm ci’ to install the exact dependency tree? Feels more like an oversight from the developers rather than a JavaScript problem. When you want to upgrade, only then do you run all regression tests and do so.

I agree with this. But dont just use `npm ci`on prod builds since that would typically include all the dev dependencies as well in your production builds, which is not usually desirable. It might be possible to add the `--only=production` flag to npm ci? But otherwise, as pointed out, pinned versions are needed for all dependencies.

Re: A JavaScript Nightmare

#16
post #5
post #4

[flagged]

To be fair, JavaScript is harder that most people think, the problem is that everyone thinks they are an expert, so we end up with this kind of problems. There is a lack of engineering discipline and too much hacking!

Javascript is way easier than most people think. The problems come when they try to force their preconceived notions on it, and/or they don't keep it simple. Sure, complex things can be done with Javascript but as you said, it takes discipline.

Re: A JavaScript Nightmare

#17
> One tiny version mismatch or breaking change can bring your mission-critical application to a standstill, as we painfully experienced.

This is true in many other languages, not just Javascript. This isn't a "Javascript nightmare", this is a dependency nightmare.

Re: A JavaScript Nightmare

#18
This is the second time I've ended up reading this post, and I confess I still don't exactly understand what was going on here. There's an issue with PDFs missing their contents, but also timeouts and a missing method exception? The problem seems to have come from upgrading some dependencies at some point, but the solution is also an upgrade, as far as I can tell? And then the cache issues at the end sound very much like a red flag in terms of managing JS dependencies - as if they're trying to cache the node_modules directory in some way that isn't properly configured.

That said, the main sense I get is that the team aren't so experienced with Javascript, and therefore working with it is full of surprises because they just aren't used to it. I found the line about bugs in C code being "your fault" particularly amusing: having occasionally had to touch C and C++ code, I would have said the complete opposite! Javascript, for me, is very predictable - if something goes wrong, then it's usually because I made a clear mistake. But with C, I end up trying to debug chains of Makefile and CMake problems that have no rhyme or reason to them.

In other words: as someone inexperienced in C, it is a chaotic, magical language and ecosystem to me, in exactly the same way that the author describes Javascript being to them.

More practically, it sounds like the team need some regression tests for this case that they can run next time they try and upgrade their dependencies. They also need to make sure that caching is working properly for their Javascript code - rerunning the CI multiple times on the same commit should always produce exactly the same dependency tree every time. Probably that means caching the right directory and using NPM CI to clear and rebuild node_modules from scratch every time.

More generally, the author complains about a lack of type checks. In this case, it sounds like the missing method was somewhere in a dependency, so this may not have helped, but: Typescript! It exists, it adds types, it makes a lot of things easier. Easy mode Typescript is to just start writing `.ts` files and use the `tsx` package to automatically compile and execute everything - there are other approaches that they could explore, but this is probably the simplest.

Re: A JavaScript Nightmare

#20

Shouldn’t you use fixed versions and use something like ‘npm ci’ to install the exact dependency tree? Feels more like an oversight from the developers rather than a JavaScript problem. When you want to upgrade, only then do you run all regression tests and do so.

I agree with this. But dont just use `npm ci`on prod builds since that would typically include all the dev dependencies as well in your production builds, which is not usually desirable. It might be possible to add the `--only=production` flag to npm ci? But otherwise, as pointed out, pinned versions are needed for all dependencies.

That flag exists (or an equivalent, I forget what the exact syntax is).
Post reply on HN