4 ms·

>one thing I love about npm, it defaults to all tools and dependencies being versioned and local. No list of tools and system libs I need to install. That is n

>one thing I love about npm, it defaults to all tools and dependencies being versioned and local. No list of tools and system libs I need to install. That is not unique to npm. Java/Maven, Ruby/Bundler, Go/Vendor also work like this and I believe that several other languages might work like this. Comparing npm with C/C++ build/package tools is setting a very low bar

skrebbel 7y ago
True, but it's nice for JS land that NPM got it right the first time. Ruby gems sucked before bundler (and last I checked, bundler still isn't cross-platform, it's nuts), I lost count of how many Go package managers get published. For at least a decade all of Java land downloaded JARs and put them into the CLASSPATH. It really took quite a while for programming communities to accept that that local packages are a good thing, and NPM was early to the party. And NPM does this recursively, which I think it what greggman is primarily getting at. I don't think many other package managers do this. I mean, the fact that a package's dependencies are local to it too is fundamental. You simply can't get dependency version conflicts (except if package authors do terrible global state hacks, and fortunately this is pretty unheard of). Instead, you just pull in 5 different versions of some logging library or some http client wrapper, and you don't even notice. That's not without its own downsides, but I prefer it to the steaming pile of `override` directives in our Elixir codebase has day.
- kkapelon 7y ago
  >I don't think many other package managers do this Unless I am missing something, "go mod vendor", and "mvn package" will work in the same manner. They will download all deps of the app itself PLUS all transitive dependencies. No system libraries needed (or touched)
  - skrebbel 7y ago
    I'm no expert, but given the amount of hits "maven dependency conflicts" I get on Google, strongly doubt Maven works the same. Last I checked, it'll indeed pull in all transitive dependencies, but if multiple dependencies need the same subdependency of a different version, you need to work out conflicts. JS simply doesn't have this problem, it's splendid.
    - kkapelon 7y ago
      "maven dependency conflicts" is when a SINGLE project has issues with its own dependencies because of bad configuration. Multiple unrelated projects can use the same or different version of a library without any issues

skrebbel 7y ago

True, but it's nice for JS land that NPM got it right the first time. Ruby gems sucked before bundler (and last I checked, bundler still isn't cross-platform, it's nuts), I lost count of how many Go package managers get published. For at least a decade all of Java land downloaded JARs and put them into the CLASSPATH. It really took quite a while for programming communities to accept that that local packages are a good thing, and NPM was early to the party. And NPM does this recursively, which I think it what greggman is primarily getting at. I don't think many other package managers do this. I mean, the fact that a package's dependencies are local to it too is fundamental. You simply can't get dependency version conflicts (except if package authors do terrible global state hacks, and fortunately this is pretty unheard of). Instead, you just pull in 5 different versions of some logging library or some http client wrapper, and you don't even notice. That's not without its own downsides, but I prefer it to the steaming pile of `override` directives in our Elixir codebase has day.

kkapelon 7y ago
>I don't think many other package managers do this Unless I am missing something, "go mod vendor", and "mvn package" will work in the same manner. They will download all deps of the app itself PLUS all transitive dependencies. No system libraries needed (or touched)
- skrebbel 7y ago
  I'm no expert, but given the amount of hits "maven dependency conflicts" I get on Google, strongly doubt Maven works the same. Last I checked, it'll indeed pull in all transitive dependencies, but if multiple dependencies need the same subdependency of a different version, you need to work out conflicts. JS simply doesn't have this problem, it's splendid.
  - kkapelon 7y ago
    "maven dependency conflicts" is when a SINGLE project has issues with its own dependencies because of bad configuration. Multiple unrelated projects can use the same or different version of a library without any issues