3 ms·

I never quite got a warm-fuzzy feeling from npm -- the tool, the service, the company. This announcement does nothing to help, from my perspective. Is my depe

I never quite got a warm-fuzzy feeling from npm -- the tool, the service, the company. This announcement does nothing to help, from my perspective. Is my dependency on this or that JavaScript library something that really needs to be owned by a for-profit company? I also kind of wonder what is the real value of a centralized repository versus just directly referencing git repos. I haven't used this gpk[0] project yet, but it looks like an interesting alternative, on paper. [0]: https://github.com/braydonf/gpk https://github.com/braydonf/gpk

Waterluvian 7y ago
You can still reference repos directly with npm.
coderzach 7y ago
You'd be surprised how often git repos disappear when you have 100s or 1000s of deps.
Touche 7y ago
Immutability and semver are the reasons
- montroser 7y ago
  Can't we get all that directly from git repos and signed tags?
  - AgentME 7y ago
    People can take down their git repos, or remove branches/commits/tags.
KenanSulayman 7y ago
Much better: mandatory vendoring of packages. Can't break and being forced to push the packages to the repo makes you appreciate the lack of transient dependencies.