Live data from Hacker News

A one-line package broke `npm create-react-app`

github.com

51–60 of 478 posts

Re: A one-line package broke `npm create-react-app`

#51
post #7

And the source code of the library is: function isPromise(obj) { return !!obj && (typeof obj === 'object' || typeof obj === 'function') && typeof obj.then === 'function'; }

how does that make sense in any universe. Just because I have a function named "then" does not mean that my object is a promise. Maybe "then" is the name of a domain thing in my project, for instance a small DSL or something like that. arghhhhhh !

Re: A one-line package broke `npm create-react-app`

#52

Earlier quoted context omitted.

My prior decision to never work with JavaScript again has just grown firmer.

I second this, JavaScript Devs are near the bottom of the food chain, just above VB Devs. Myself as a Java developer is middle of the pyramid. The apex predators are embedded developers, followed by c Devs then game Devs.

The “food chain?” What do you mean by that?

Re: A one-line package broke `npm create-react-app`

#53

The javascript ecosystem is a total house of cards, "webshit" as they call it in some other sites, rings true more and more.

Agreed. Libraries and tools often don't work in a straightforward manner. Lots of tools reach below the surface and do their own tampering and monkey-patching of the runtime, module system or environment. Layer upon layer gets deposited over time. It's like doing construction on topsoil riddled with unmarked gas, water, and electrical lines.

Re: A one-line package broke `npm create-react-app`

#54

This is why regression suites are important. EDIT: I wasn't dissing the developers. They have regression, this was just an accident. I was stating it is important. My bad (too late to delete).

Could create-react-app have avoided this through regression suites?

Not really. NPM relies heavily on semver - https://semver.org/. In this case, the package that was updated updated a minor version, which means it should be backwards compatible, but it wasn't for later versions of Node.

Of course, you can always lock your build to exact versions of your dependencies (lock files in NPM used to be a complete cluster, in my opinion they are less of a cluster now - you can pretty much do everything you want with them but there are some gotchas that make it easy to shoot yourself in the foot). The issue is that when you run 'npm install', it will pull the latest semver-compatible versions of your dependencies.

So for everyone decrying how this is a bad example of NPM and the javascript ecosystem, I really think the opposite is true. Yes, it broke a lot of upstream dependencies, but importantly only for new builds of those items, and furthermore it was found almost immediately.

Also, of course, you can specify exact versions of your dependencies - you don't have to rely on semver. That means, though, that you need to be more vigilant about pulling in bug fixed and security fixes, and most people take the tradeoff that they are comfortable pulling in patch or minor versions, but using lock files once they have a build they have verified.

Re: A one-line package broke `npm create-react-app`

#55
post #7

And the source code of the library is: function isPromise(obj) { return !!obj && (typeof obj === 'object' || typeof obj === 'function') && typeof obj.then === 'function'; }

Here's my off-the-cuff take that will not be popular. A function like this should be a package . Or, really, part of standard js, maybe. A) The problem it solves is real. It's dumb, but JS has tons of dumb stuff, so that changes nothing. Sometimes you want to know "is this thing a promise", and that's not trivial (for reasons). B) The problem it solves is not straightforward. If you Google around you'll get people sa…

I'd say that it should rather be a part of the type system. Some kind of `obj isa Promise` should be the way to do this, not random property checks. But that's JS...

Re: A one-line package broke `npm create-react-app`

#56

Earlier quoted context omitted.

My prior decision to never work with JavaScript again has just grown firmer.

I second this, JavaScript Devs are near the bottom of the food chain, just above VB Devs. Myself as a Java developer is middle of the pyramid. The apex predators are embedded developers, followed by c Devs then game Devs.

I sincerely hope you're being sarcastic here.

Re: A one-line package broke `npm create-react-app`

#58

Earlier quoted context omitted.

Could create-react-app have avoided this through regression suites?

Bumping your comment because I would like to know. I'm following the github thread.

If they'd pinned the dependency versions, and ran the tests before updating the pins, the tests should have catched it.

Re: A one-line package broke `npm create-react-app`

#59

Earlier quoted context omitted.

Here's my off-the-cuff take that will not be popular. A function like this should be a package . Or, really, part of standard js, maybe. A) The problem it solves is real. It's dumb, but JS has tons of dumb stuff, so that changes nothing. Sometimes you want to know "is this thing a promise", and that's not trivial (for reasons). B) The problem it solves is not straightforward. If you Google around you'll get people sa…

I'd say that it should rather be a part of the type system. Some kind of `obj isa Promise` should be the way to do this, not random property checks. But that's JS...

I'm totally with you on this. It's dumb that this is a problem but it is actually a problem.

Re: A one-line package broke `npm create-react-app`

#60

Earlier quoted context omitted.

Here's my off-the-cuff take that will not be popular. A function like this should be a package . Or, really, part of standard js, maybe. A) The problem it solves is real. It's dumb, but JS has tons of dumb stuff, so that changes nothing. Sometimes you want to know "is this thing a promise", and that's not trivial (for reasons). B) The problem it solves is not straightforward. If you Google around you'll get people sa…

I'd say that it should rather be a part of the type system. Some kind of `obj isa Promise` should be the way to do this, not random property checks. But that's JS...

In theory `x instanceof Promise` would work, but the reason for this package is that there are many non-standard Promise implementations in the JS world.
Post reply on HN