Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A one-line package broke `npm create-react-app`

github.com

Post reply on HN
Print view View original

91–100 of 478 posts

Re: A one-line package broke `npm create-react-app`

#91

Post by ehsankia »

kroltan wrote: post #75
degraafc wrote: post #55

Earlier quoted context omitted.

I'd say that it should rather be a part of the type system. Some kind of `obj isa Promise` should be the way to do this, not random property checks. But that's JS...

The thing is that there is the Promise "class", which is provided by the environment, but there is a interface called PromiseLike, which is defined as having a method called then that takes one or two functions. Now, JS doesn't have nominal typing for interfaces, so you have to do "random property checks". Typescript partially solves that by declaring types, but if you have a any variable, you still need to do some p…

shouldn't it then be called is-promise-like? Also, if you're being loose about it anyways, can't you simply just go for `if (obj && typeof obj.then == 'function')` and call it a day? I'd say that's short enough to include your own version and not rely on a package for.

I think that module over complicates it as it is, and most people don't need that level of complication in their code.

Re: A one-line package broke `npm create-react-app`

#92

Post by ng12 »

Noumenon72 wrote: post #21
ng12 wrote: post #9

Looks like it broke @angular/cli too.

Who does this affect? I just did npx @angular/cli new hello-world-project and that worked. I have remote Angular training on Monday and didn't want to do a global install.

It's already been patched with version 2.2.1.

Re: A one-line package broke `npm create-react-app`

#93

Post by progval »

zulgan wrote: post #42

Chill with the js hate, this happens everywhere. Maybe not to this extend, but if X (where X is whatever you are thinking about) had similar amount of people using it (especially junior people) this would happen there as well.

This happens because libraries installed by create-react-app depend on many other libraries (1026 transitive dependencies as of today).

As a comparison, Django, a large Python web framework, has only three dependencies (pytz, sqlparse, and asgiref), which don't have dependencies themselves

Re: A one-line package broke `npm create-react-app`

#94

Post by staticassertion »

mikewhy wrote: post #87
montroser wrote: post #43

Everyone crying about this on the Internet would do better to just take it as an easy lesson: pin your dependency versions for projects running in production. This was an honest oversight, and even somewhat inevitable with so many expected supported ways to import/export between cjs mjs amd umd etc. It will happen again. And when it happens the next time, if it ruins your life again, take issue with yourself for not…

> pin your dependency versions for projects running in production Works for existing apps, but people using create-react-app and angular CLI can't even start a new project.

I don't know much about those projects, but why did this break them? Are they not pinning versions?

Re: A one-line package broke `npm create-react-app`

#95

Post by enitihas »

0xff00ffee wrote: post #22
seibelj wrote: post #12

Earlier quoted context omitted.

Install any moderately complex nodejs lib or app and it will throw tons of warnings, ignored errors, and security issue alerts. As you should with any app running in production, lock down everything and watch network traffic because there are innumerable backdoors in the JavaScript ecosystem.

My company's current production electron app has 360 npm dependencies. We have CI for the UI but not for the USB/FFI stack, so any time we have to touch that code everyone blanches. > innumerable backdoors in the JavaScript ecosystem. Same goes for Python and CPAN. Any "click here for fancy module" installer has this problem.

You don't need so many dependencies with python. Python is a batteries included language, and so are most python libraries.

Re: A one-line package broke `npm create-react-app`

#96

Post by ehsankia »

2ion wrote: post #50
chvid wrote: post #7

And the source code of the library is: function isPromise(obj) { return !!obj && (typeof obj === 'object' || typeof obj === 'function') && typeof obj.then === 'function'; }

Wow just wow. So here's your new Promise object: class World { then () { return 0; } } isPromise(new World) // true If there really isn't a safe and better way to tell if an object is an instance of Promise…then color me impressed.

Or just:

    const p = {then: () => 0}

Re: A one-line package broke `npm create-react-app`

#97

Post by yandie »

staticassertion wrote: post #94
mikewhy wrote: post #87

Earlier quoted context omitted.

> pin your dependency versions for projects running in production Works for existing apps, but people using create-react-app and angular CLI can't even start a new project.

I don't know much about those projects, but why did this break them? Are they not pinning versions?

Because they are starting a new project from scratch and would have nothing to pin their dependencies against?

Re: A one-line package broke `npm create-react-app`

#98

Post by jackewiehose »

krapp wrote: post #71
jackewiehose wrote: post #49

I think these one-line-packages aren't the right way to go. Either JS-developers should skip the package-system in that case and just copy and paste those functions into their own project or there should be more common used packages that bundle these one-liners. I mean is_promise() and left_pad() are not worth their own package. Packages-dependencies of 10000 packages for trivial programs are just insane. Is someone…

>Is someone going to fix that? Probably not. There is too much code in the wild, and NPM owns the entire JS ecosystem, and there has been too much investment in that ecosystem and its culture at this point for a change in course to be feasible. The JS universe is stuck with this for the foreseeable future.

Does it need much to change? I didn't mean to fix NPM. The problem is the non-existing standard-library. Just create one that everybody will use and everybody could cut their dependencies by thousands.

Re: A one-line package broke `npm create-react-app`

#99

Post by throwanem »

2ion wrote: post #50
chvid wrote: post #7

And the source code of the library is: function isPromise(obj) { return !!obj && (typeof obj === 'object' || typeof obj === 'function') && typeof obj.then === 'function'; }

Wow just wow. So here's your new Promise object: class World { then () { return 0; } } isPromise(new World) // true If there really isn't a safe and better way to tell if an object is an instance of Promise…then color me impressed.

I mean, if you have to assume deliberately adversarial action on the part of your own codebase, you may have worse problems than having to duck-type promises.
Post reply on HN