4 ms·
It's not the dependencies that cause me concern. It's the dependencies of the dependencies.
by scandox 8y ago
It's not the dependencies that cause me concern. It's the dependencies of the dependencies.
- jononor 8y agoThis. The direct dependencies are usually quite manageable. As a project developer, I know what they do, why they were chosen, roughly how it works, and have decided that the risk is worth it. This is not the case for sub, subsub... dependencies, and there are soo many. If the tree was flatter due-dilligence would be much easier. Library authors. Please be extremely conservative in when to pull in dependencies. I will prioritize this higher for projects that I maintain.
- karmakaze 8y agoThis reasoning has a problem. We should always be concerned with dependencies and always keep them to the minimum you can correctly get by with. The problem with thinking these x packages are OK for this library is how we got where we are. Yes we could just avoid using trivial libraries, but even for the other ones the decision to add it into your lib has to be made in the context of the app or lib, or lib's lib using your library. If you only imagine your lib being directly used, your scales a d judgements could be way off the actual cost/bebefit.