Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A one-line package broke `npm create-react-app`

github.com

Post reply on HN
Print view View original

111–120 of 478 posts

Re: A one-line package broke `npm create-react-app`

#111

Post by mikewhy »

staticassertion wrote: post #104
yandie wrote: post #97

Earlier quoted context omitted.

Because they are starting a new project from scratch and would have nothing to pin their dependencies against?

Maybe I'm misunderstanding how those projects work. From what I recall, they generate a project, including the package.json. So I'm not sure why they couldn't just generate the package.json with pinned versions? I don't write much JS, and have only used create-react-app just a few times, so feel free to explain why this isn't possible.

package.json only lists top-level dependencies. package-lock.json tracks all dependencies, and dependencies of dependencies. is-promise is one of those dependencies of a dependency, which you don't have much control over.

Re: A one-line package broke `npm create-react-app`

#112

Post by krapp »

jackewiehose wrote: post #98
krapp wrote: post #71

Earlier quoted context omitted.

>Is someone going to fix that? Probably not. There is too much code in the wild, and NPM owns the entire JS ecosystem, and there has been too much investment in that ecosystem and its culture at this point for a change in course to be feasible. The JS universe is stuck with this for the foreseeable future.

Does it need much to change? I didn't mean to fix NPM. The problem is the non-existing standard-library. Just create one that everybody will use and everybody could cut their dependencies by thousands.

Not everyone would use it, that's my point. The inertia behind the existing system is too great, especially in enterprise. All that would happen is that library would become just another Node package, and then you've got the "n+1 standards" problem.

The "nonexistent standard library" wasn't a problem in the days when javascript development meant getting JQuery and some plugins, or some similar library. It only became a problem after the ecosystem got taken over by a set of programming paradigms that make no sense for the language.

Yes, in my mind you'd have to change everything from the ground up, starting with no longer using javascript outside of the browser.

Re: A one-line package broke `npm create-react-app`

#113

Post by bdcravens »

zulgan wrote: post #42

Chill with the js hate, this happens everywhere. Maybe not to this extend, but if X (where X is whatever you are thinking about) had similar amount of people using it (especially junior people) this would happen there as well.

Perhaps, but I think the JS ecosystem encourages dependency explosion like no other. Looking at a 6 or 7 year old lazily written Rails app, with a lot of functionality written throughout the years, I see about 200 gems. Creating an empty app with create-react-app, it has about 1000 packages.

Re: A one-line package broke `npm create-react-app`

#114

Post by mikewhy »

montroser wrote: post #108
mikewhy wrote: post #87

Earlier quoted context omitted.

> pin your dependency versions for projects running in production Works for existing apps, but people using create-react-app and angular CLI can't even start a new project.

Nah, create-react-app and others could easily pin dependencies of libraries they install in your new project to known-good versions. Without doing that bit of diligence, this type of issue should be 100% expected.

By doing that they would avoid this issue, for sure. They would also introduce security issues by using old versions.

And this would do nothing for the fact that `npm install eslint && ./node_modules/.bin/eslint` was also failing.

Re: A one-line package broke `npm create-react-app`

#115

Post by montroser »

tgv wrote: post #65
montroser wrote: post #43

Everyone crying about this on the Internet would do better to just take it as an easy lesson: pin your dependency versions for projects running in production. This was an honest oversight, and even somewhat inevitable with so many expected supported ways to import/export between cjs mjs amd umd etc. It will happen again. And when it happens the next time, if it ruins your life again, take issue with yourself for not…

> pin your dependency versions And then to see "npm detected 97393 problems" or whatever the message exactly is.

You don't need to pin them forevermore -- just when you don't want everything to break unexpectedly :).

When you want to upgrade your dependencies, then go ahead and do that, on your own schedule, with time and space to fix whatever issues come up, update your tests, QA, etc.

Re: A one-line package broke `npm create-react-app`

#116

Post by winrid »

2OEH8eoCRo0 wrote: post #109
montroser wrote: post #43

Everyone crying about this on the Internet would do better to just take it as an easy lesson: pin your dependency versions for projects running in production. This was an honest oversight, and even somewhat inevitable with so many expected supported ways to import/export between cjs mjs amd umd etc. It will happen again. And when it happens the next time, if it ruins your life again, take issue with yourself for not…

I'm a novice in this area but if your project relies on a bunch of external node packages why wouldn't you download them all and host them locally or add them to version control?

You'd use a proxy, yes.

Re: A one-line package broke `npm create-react-app`

#117

Post by bambataa »

create-react-app was broken a couple of weeks ago when I tried to use the Typescript template. Some dependency in Jest had been changed to require a version of Typescript that had only been out for a few weeks, breaking everything (including create-react-app) that hadn't updated to the latest tsc. What an ecosystem.

Re: A one-line package broke `npm create-react-app`

#119

Post by btilly »

montroser wrote: post #43

Everyone crying about this on the Internet would do better to just take it as an easy lesson: pin your dependency versions for projects running in production. This was an honest oversight, and even somewhat inevitable with so many expected supported ways to import/export between cjs mjs amd umd etc. It will happen again. And when it happens the next time, if it ruins your life again, take issue with yourself for not…

And everyone who depends on projects that pin their dependency versions gets to be victims of security exploits long after they are fixed.

Dependency management is not as simple as you seem to think.

Post reply on HN