Live data from Hacker News

A one-line package broke `npm create-react-app`

github.com

21–30 of 478 posts

Re: A one-line package broke `npm create-react-app`

#22
post #12

This is why regression suites are important. EDIT: I wasn't dissing the developers. They have regression, this was just an accident. I was stating it is important. My bad (too late to delete).

Install any moderately complex nodejs lib or app and it will throw tons of warnings, ignored errors, and security issue alerts. As you should with any app running in production, lock down everything and watch network traffic because there are innumerable backdoors in the JavaScript ecosystem.

My company's current production electron app has 360 npm dependencies. We have CI for the UI but not for the USB/FFI stack, so any time we have to touch that code everyone blanches.

> innumerable backdoors in the JavaScript ecosystem.

Same goes for Python and CPAN. Any "click here for fancy module" installer has this problem.

Re: A one-line package broke `npm create-react-app`

#23
post #7

And the source code of the library is: function isPromise(obj) { return !!obj && (typeof obj === 'object' || typeof obj === 'function') && typeof obj.then === 'function'; }

My prior decision to never work with JavaScript again has just grown firmer.

Re: A one-line package broke `npm create-react-app`

#24
post #6

The package referred to in the clickbait title is `is-promise`

I don't know how "clickbait" that title can be when it is, in fact, longer than the line of code in question: declare function isPromise (obj: Promise | S): obj is Promise ; This is, indeed, the only line of exported code in the entire package. I genuinely don't understand the NPM world.

[deleted]

Re: A one-line package broke `npm create-react-app`

#25
post #6

The package referred to in the clickbait title is `is-promise`

I don't know how "clickbait" that title can be when it is, in fact, longer than the line of code in question: declare function isPromise (obj: Promise | S): obj is Promise ; This is, indeed, the only line of exported code in the entire package. I genuinely don't understand the NPM world.

NPM is the answer to the question: what would happen if everyone refused to use any idioms ever, and instead replace them all with packages?

God help you, if you import a JavaScript (or Rust) package today. Lest you fall in a gaping chasm of endless cascading dependencies.

Re: A one-line package broke `npm create-react-app`

#26
post #6

Earlier quoted context omitted.

I don't know how "clickbait" that title can be when it is, in fact, longer than the line of code in question: declare function isPromise (obj: Promise | S): obj is Promise ; This is, indeed, the only line of exported code in the entire package. I genuinely don't understand the NPM world.

Me neither. I can't wait for Deno 1.0 next month. https://deno.land/

How exactly will the new runtime fix the habit of Javascript developers to pull-in millions of dependencies?

Re: A one-line package broke `npm create-react-app`

#27
post #6

Earlier quoted context omitted.

I don't know how "clickbait" that title can be when it is, in fact, longer than the line of code in question: declare function isPromise (obj: Promise | S): obj is Promise ; This is, indeed, the only line of exported code in the entire package. I genuinely don't understand the NPM world.

Me neither. I can't wait for Deno 1.0 next month. https://deno.land/

What is this exactly? The website is a bit unclear.

Re: A one-line package broke `npm create-react-app`

#28

This is why regression suites are important. EDIT: I wasn't dissing the developers. They have regression, this was just an accident. I was stating it is important. My bad (too late to delete).

Could create-react-app have avoided this through regression suites?

Bumping your comment because I would like to know. I'm following the github thread.

Re: A one-line package broke `npm create-react-app`

#29
post #12

This is why regression suites are important. EDIT: I wasn't dissing the developers. They have regression, this was just an accident. I was stating it is important. My bad (too late to delete).

Install any moderately complex nodejs lib or app and it will throw tons of warnings, ignored errors, and security issue alerts. As you should with any app running in production, lock down everything and watch network traffic because there are innumerable backdoors in the JavaScript ecosystem.

Please show the community the back spots you are aware of.
Post reply on HN