3 ms·
> Those who argue that having a dependency like left-pad adds risk to their project are essentially arguing against having any external npm dependancies in thei
by ejcx 11y ago
> Those who argue that having a dependency like left-pad adds risk to their project are essentially arguing against having any external npm dependancies in their project.
No they absolutely are not. Having a few dependencies is something that almost all software has.
Depending on left pad means more than just "I'll have problems if it is removed".
It means you'll have problems if it is modified. It means you'll have problems if it has a vulnerability that needs to be fixed. It means you'll have problems in tons of different circumstances. Depending on things willy-nilly is a bad practice.
Trusting left pad written by god knows who is a little different than trusting something like jquery that has been around for 15 years.
- bitmilitia 11y agoIf your referring to external dependancies as "how many times you require a dependency in your code", then realize that large projects like babel are actually composed of smaller dependencies under the covers: https://github.com/babel/babel/tree/master/packages https://github.com/babel/babel/tree/master/packages So wrapping smaller packages in a larger package doesn't change whats happening behind the scenes. If your referring to "just not having external dependancies at all" then good luck writing anything of value without first recreating the wheel. As to the question of if the code is modified, thats what semver is for. Production apps should always link to a specific version of a library.