The Everything NPM Package

Post by matheusmoreira » Sun, Jan 07, 2024, 7:48 AM UTC

TobyTheDog123 wrote: post #13

superasn wrote: post #7

I've seen a lot of people criticise npm and their policies but I've never come across a solution. Npm has its flaws and while there are such abuses like everything package, is-odd, left-pad, etc there are also many useful packages like vue, sortable, etc without which development will be a huge pain. So not asking rhetorically, if we had all the insight and knowledge we have now, how would you make it different?

The entire reason this is a big deal is that people don't know what their dependencies are. The left-pad incident wasn't a big deal because it was pulled, it was a big deal because no one could easily fix their builds and didn't even know they were depending on it, because it was a dependency of a dependency of a dependency. While it's ridiculous to expect that people will audit every single dependency and sub-depend…

Post by dzhiurgis » Sun, Jan 07, 2024, 7:55 AM UTC

coderedart wrote: post #98

cxr wrote: post #76

Earlier quoted context omitted.

I know it's five hours later and this question has already spawned dozens of responses, but it's worth thinking and speaking clearly if we're trying to arrive at a solution for something. We can start by saying exactly what we're talking about—how do you make what different? Because you mention npm "and their policies" but then switch gears and talk about "is-odd", which is not a policy issue. It's rather something e…

> Whatever the solution to it might be, vague and fuzzy questions—while magnets for chatter since they can stand in for whatever someone wants to read out of them—are not the way to get there. This is a great line. If HN had a quote of the month or something, this should be nominated for that.

Post by mcny » Sun, Jan 07, 2024, 8:29 AM UTC

aaomidi wrote: post #16

TobyTheDog123 wrote: post #13

Earlier quoted context omitted.

The entire reason this is a big deal is that people don't know what their dependencies are. The left-pad incident wasn't a big deal because it was pulled, it was a big deal because no one could easily fix their builds and didn't even know they were depending on it, because it was a dependency of a dependency of a dependency. While it's ridiculous to expect that people will audit every single dependency and sub-depend…

This is why I prefer vendoring dependencies. I have to actually code review them.

Post by rfoo » Sun, Jan 07, 2024, 9:19 AM UTC

superasn wrote: post #7

I've seen a lot of people criticise npm and their policies but I've never come across a solution. Npm has its flaws and while there are such abuses like everything package, is-odd, left-pad, etc there are also many useful packages like vue, sortable, etc without which development will be a huge pain. So not asking rhetorically, if we had all the insight and knowledge we have now, how would you make it different?

Post by int_19h » Sun, Jan 07, 2024, 9:36 AM UTC

moritzwarhier wrote: post #64

int_19h wrote: post #55

Earlier quoted context omitted.

There are still so many basic things that aren't in the JS stdlib, though. A good example is Map - if you need to use a tuple of two values as a key, you're SOL because there's no way to customize key comparisons. Hopefully we'll get https://tc39.es/proposal-record-tuple/ eventually, but meanwhile languages ranging from C++ to Java to Python have had some sensible way to do this for over 20 years now.

There is a trivial way to have custom key comparisons: write a function that returns the key you want. You can implement equals() using some kind of serialization, or using a lookup table of references - whatever you want! Of course, Records and Tuples would greatly simplify the process.