6 ms·
Ah, in this case, I would then have to commit my dependencies into my VCS to maintain reproducible builds. I'm not sure I like that solution very much either. I
by bgdam 6y ago
Ah, in this case, I would then have to commit my dependencies into my VCS to maintain reproducible builds. I'm not sure I like that solution very much either. I've seen node_modules in multiple GBs, and I'm sure Deno's dependency sizes are going to be similar.
- nitsky 6y agoIn practice modules will be available from sources that will have similar reliability to npm: github.com, unpkg.com, cdn.pika.dev, jspm.io, etc.
- bgdam 6y agoWhich then raises the question - how is it better than NPM? If there are going to be centralized repositories (like NPM), and if I have to download my dependencies into a $DENO_DIR (like NPM), and if I am then loading these dependencies from local files (like NPM), how is it any different to NPM? Except for being less secure by default? This is starting to look like a case of being different just so you can say you're different.
- austincheney 6y agoNPM is a dependency management failure which is why you are ending up with hundreds of dependencies in the first place. It sounds like you want to reproduce that insanity in Deno. Deno is set up in such a way to dissuade you from the stupidity by default but allow it in very few steps if you cannot imagine a world without it. In my opinion this is Deno’s biggest selling point.
- bgdam 6y ago> Deno is set up in such a way to dissuade you from the stupidity by default but allow it in very few steps if you cannot imagine a world without it. Could you elaborate on this? Is it that Deno is against the whole 'small packages that do one thing well' principle and instead in favor of complete libaries? How exactly would it dissuade me from installing hundreds of dependencies?
- austincheney 6y agoThe default design style for a Deno application is that the application becomes a single file. Just like packages coming off Steam. This requires that dependencies are packaged into the application before it is distributed to others. The idea there is to include only what you need deliberately and it manage it as a remotely written extension of your application.
- bgdam 6y agoHaving a single executable file, makes distribution easier, but while I'm developing the app, I'll still have to manage all of it's dependencies right? How does Deno aid during development? > The idea there is to include only what you need deliberately and it manage it as a remotely written extension of your application. I have a node app, in which I deliberately only included the dependencies I need. The package.json lists exactly 8 dependencies. However, the node_modules folder already has 97 dependencies installed into it. The reason of course is that these are dependencies of dependencies of dependencies of dependencies. Wouldn't Deno have this same issue? Are the dependencies also distributed in compiled form as a single file akin to windows DLLs?
- nitsky 6y agoit's better because there will be more choice.
- riyakhanna1983 6y agoDoesn't this mean more opportunities to inject malicious code?
- austincheney 6y agoOnly if you tell your application to retrieve from untrusted locations.
- pknopf 6y agoNode supports node_modules, not npm. Anything can build the node_modules.
- searchableguy 6y agoI am always confused by deno folks. You can install from a git repository using yarn/npm. How is that not "decentralisation" And if you are importing single files from a remote url, I would question your sanity.
- nitsky 6y ago> install from a git repository using yarn/npm yep, that's basically the same. deno has the benefit of using the es module system like it is implemented in browsers.
- batmansmk 6y agoTo solve your issue, you would do exactly how you do your node deployments: download the deps in a folder in CI, then deploy the whole build.
- bgdam 6y agoExcept that now, the download deps in CI step can fail if one of hundreds of websites for my hundreds of dependencies goes down. If the main NPM repository goes down, I can switch to a mirror and all of my dependencies will be available again.
- ricardobeat 6y agoYou answered your own question. Nothing stops you from using a mirror with deno too.
- bgdam 6y agoWhich again brings me back to something I'm still not understanding - How is Deno's package management better than NPM if it is extremely similar to NPM, but slightly less secure? I'm only asking because lots of people seem to be loving this new dependency management, so I'm pretty sure I'm missing something here.
- mrkurt 6y agoI like it because it's simpler. I know what happens when I import from a URL. I'd have a hard time whiteboarding exactly what happens when I `npm install`.
- searchableguy 6y agoWhat happens?
- sakarisson 6y ago
- littlestymaar 6y agoTrue, but that's what people using Go have been doing for years without complaining much, so I guess it works fine for most workload. And before npm fixed things after the left-pad incident, the npm builds where not reproducible either (as demonstrated by the said left-pad incident).
- Bahamut 6y agoDependency management is one of the biggest complaints I have seen around Go - I don't think this is accurate.
- littlestymaar 6y agoI don't like it either, but it still works well enough for many people.
- thayne 6y agoThat is one of the things I hate about go. Right up there with lack of generics and boilerplate error handling.
- pawalt 6y agoThis hasn't been a thing in Go for a long time. Go dep and now go modules fix this.
- qudat 6y ago> True, but that's what people using Go have been doing for years without complaining much, so I guess it works fine for most workload. I hate to break it to you but dependency management has been a massive issue in golang until the devs formally adopted go mod. Only Google seemed okay with checking in their dependencies to version control. Everyone else was doing crazy hacks like https://labix.org/gopkg.in https://labix.org/gopkg.in
- Rapzid 6y agoIt created a hugely fractured open source ecosystem as well.
- simonw 6y agoYou could use a separate git repository for the dependencies. That way you keep your core project repo tight and small and clean, but you still have your dependencies under version control. If that separate repo grows to a few GBs or more it doesn't really hurt anything.
- drbw 6y agoOr use something like Nexus or Artifactory to host a private copy of dependencies.
- deleted 6y ago[deleted]