3 ms·

Most companies using Node probably also have some form of CI. For example the company I work at probably generates tens of thousands of package downloads a day

Most companies using Node probably also have some form of CI. For example the company I work at probably generates tens of thousands of package downloads a day because we have CI running docker container builds for automated testing on every commit, and each container build downloads packages from scratch for an entirely fresh build. Once a container is built and passes tests it is reused as many times as needed for deploying out on edge hosts so there are no more additional package downloads after that, but still the continual CI builds throughout the day as people commit code generate a lot of downloads.

optimusclimb 11y ago
FWIW, in that situation, a company should be using their own npm repo, not hitting the public NPM. Artifactory provides one such solution. It blows me away that so many companies so late in the game still do things like deploy from github, or do CI/CD hitting things like PyPI or NPM constantly. Yes, these services are generally reliable. If you have a critical release to push, should github being down be an acceptable reason to not be able to deploy it?
danbruc 11y ago
Why would you download dependencies on each build instead of once you integrate a new dependency into the project and then just keep it under source control?
- NathanKP 11y ago
  If you have a thorough test suite then it is possible to use a package version pattern such as ~1.1.0, or even ^1.1.0 to allow the package to upgrade automatically when the maintainer releases a new version. Obviously being able to do this is highly dependent on having really thorough test coverage to make sure that automatic package upgrades don't break stuff, but this would be one primary reason for downloading dependencies fresh for each build. But even if you had locked down the package versions it still wouldn't be a good idea to commit the package into your source control. Part of the benefit of hitting NPM to download the package is that package maintainers will often explicitly deprecate a package version that should now be considered outdated, or perhaps which had a security vulnerability. This will show up as a very visible warning message when running npm install. This has alerted me multiple times to issues with child modules I had added to my project, or even grandchild modules that were included by other child modules.

optimusclimb 11y ago

FWIW, in that situation, a company should be using their own npm repo, not hitting the public NPM. Artifactory provides one such solution. It blows me away that so many companies so late in the game still do things like deploy from github, or do CI/CD hitting things like PyPI or NPM constantly. Yes, these services are generally reliable. If you have a critical release to push, should github being down be an acceptable reason to not be able to deploy it?

danbruc 11y ago

Why would you download dependencies on each build instead of once you integrate a new dependency into the project and then just keep it under source control?

NathanKP 11y ago
If you have a thorough test suite then it is possible to use a package version pattern such as ~1.1.0, or even ^1.1.0 to allow the package to upgrade automatically when the maintainer releases a new version. Obviously being able to do this is highly dependent on having really thorough test coverage to make sure that automatic package upgrades don't break stuff, but this would be one primary reason for downloading dependencies fresh for each build. But even if you had locked down the package versions it still wouldn't be a good idea to commit the package into your source control. Part of the benefit of hitting NPM to download the package is that package maintainers will often explicitly deprecate a package version that should now be considered outdated, or perhaps which had a security vulnerability. This will show up as a very visible warning message when running npm install. This has alerted me multiple times to issues with child modules I had added to my project, or even grandchild modules that were included by other child modules.