Is this news? Happened so many times before. NPM is broken. Yarn 2.0 is never gonna take off. These problems have been fixed long before. Waste of life.
A one-line package broke `npm create-react-app`
101–110 of 478 posts
Re: A one-line package broke `npm create-react-app`
#102The the broken package just released a fix: https://github.com/then/is-promise/releases/tag/2.2.1
Re: A one-line package broke `npm create-react-app`
#103Earlier quoted context omitted.
Could create-react-app have avoided this through regression suites?
The regression suite never gets to run if it shares the dependency. And the system under test shouldn't even compile for the tests to run either. So it isn't so much the regression suite saving you so much as it is just acting as the client of first resort.
CRA would be running the tests, not is-promise. CRA could have pinned every dep, and had a bot (dependabot) automatically run tests against every new version of every depended-upon package, and update only when those tests pass.
Re: A one-line package broke `npm create-react-app`
#104Earlier quoted context omitted.
I don't know much about those projects, but why did this break them? Are they not pinning versions?
Because they are starting a new project from scratch and would have nothing to pin their dependencies against?
Maybe I'm misunderstanding how those projects work. From what I recall, they generate a project, including the package.json. So I'm not sure why they couldn't just generate the package.json with pinned versions?
I don't write much JS, and have only used create-react-app just a few times, so feel free to explain why this isn't possible.
Re: A one-line package broke `npm create-react-app`
#105is it idiomatic in the JS world to always express dependencies in the "version X.Y or higher", vs "version X.Y"? Most of my experience is from the java/maven world where you're playing with fire if you don't just make it "X.Y".
Re: A one-line package broke `npm create-react-app`
#106Chill with the js hate, this happens everywhere. Maybe not to this extend, but if X (where X is whatever you are thinking about) had similar amount of people using it (especially junior people) this would happen there as well.
No. Other languages don't publish/import packages that are one line of code . I have never seen an issue like this with any other language that I've worked with. Any sane developer that needed a one-liner like this would just manually implement it. Not to mention that these sorts of functions are unnecessary in languages with a good stdlib or statically typed languages like rust, etc.
Know what happens every time people like you say this here on HN? They post the one-liner they would have manually implemented in their code base and it's wrong. The one that comes to mind is the "is-negative-number" package. Yes, the geniuses of Hacker News, after finding out there was an npm package for determining whether something was a negative number, could not correctly implement that function.
You and everyone here are not as clever as you think you are. This is why people prefer known-good implementations. The maintainer here did a bad release, big fucking deal.
Re: A one-line package broke `npm create-react-app`
#107The problems that beset the Javascript ecosystem today are the same problems that beset the Unix ecosystem, back in the 90s when there still was one of those. TC39 plays the role now that OSF did then, standardizing good ideas and seeing them rolled out. That's why Promise is core now. But that process takes a long time and solutions from the "rough consensus and running code" period stick around, which is why instanceof Promise isn't enough of a test for things whose provenance you don't control.
Of course, such a situation can't last forever. If the idea is good enough, eventually someone will come along and, as Linux did to Unix, kill the parent and hollow out its corpse for a puppet, leaving the vestiges of the former ecosystem to carve out whatever insignificant niche they can. Now the major locus of incompatibility in the "Unix" world is in the differences between various distributions, and what of that isn't solved by distro packagers will be finally put to rest when systemd-packaged ships in 2024 amid a flurry of hot takes about the dangers of monoculture.
Bringing it back at last to the subject at hand, Deno appears to be trying to become the Linux of Javascript, through the innovative method of abandoning the concept of "package" entirely and just running code straight from wherever on the Internet it happens to live today. As a former-life devotee of Stack Overflow, I of course applaud this plan, and wish them all the luck they're certainly going to need.
The impetus behind "lol javascript trash amirite" channer takes today is exactly that behind the UNIX-Haters Handbook of yore. I have a printed copy of that, and it's still a fun occasional read. But those who enjoy "javascript trash lol" may do well to remember the Handbook authors' stated goal of burying worse-is-better Unix in favor of the even then senescent right-thing also-rans they favored, and to reflect on how well that played out for them.
Re: A one-line package broke `npm create-react-app`
#108Everyone crying about this on the Internet would do better to just take it as an easy lesson: pin your dependency versions for projects running in production. This was an honest oversight, and even somewhat inevitable with so many expected supported ways to import/export between cjs mjs amd umd etc. It will happen again. And when it happens the next time, if it ruins your life again, take issue with yourself for not…
> pin your dependency versions for projects running in production Works for existing apps, but people using create-react-app and angular CLI can't even start a new project.
Nah, create-react-app and others could easily pin dependencies of libraries they install in your new project to known-good versions.
Without doing that bit of diligence, this type of issue should be 100% expected.
Re: A one-line package broke `npm create-react-app`
#109Everyone crying about this on the Internet would do better to just take it as an easy lesson: pin your dependency versions for projects running in production. This was an honest oversight, and even somewhat inevitable with so many expected supported ways to import/export between cjs mjs amd umd etc. It will happen again. And when it happens the next time, if it ruins your life again, take issue with yourself for not…
I'm a novice in this area but if your project relies on a bunch of external node packages why wouldn't you download them all and host them locally or add them to version control?
Re: A one-line package broke `npm create-react-app`
#110Chill with the js hate, this happens everywhere. Maybe not to this extend, but if X (where X is whatever you are thinking about) had similar amount of people using it (especially junior people) this would happen there as well.
No. Other languages don't publish/import packages that are one line of code . I have never seen an issue like this with any other language that I've worked with. Any sane developer that needed a one-liner like this would just manually implement it. Not to mention that these sorts of functions are unnecessary in languages with a good stdlib or statically typed languages like rust, etc.
I have posted one liners to crates.io that were eventually put in the stdlib.