3 ms·
Why can't you download all the packages you use actually with your source code? That's how software has been built for decades... I'm a desktop developer so I
by fsloth 6y ago
Why can't you download all the packages you use actually with your source code? That's how software has been built for decades...
I'm a desktop developer so I understand I'm the dinosaur in the room but I've never understood why you would not cache all the component packages next to your own source code.
Since this is straighforward to do I presume there is some tradeoff I've not thought about. Is it security? Do you want to get the latest packages automatically? But isn't that a security risk as well, as not all changes are improvements?
- IshKebab 6y agoThat is exactly what NPM does.
- emerongi 6y agoYou can commit your node_modules folder into your repository if you'd like.
- Cthulhu_ 6y agoFor Node, the main tradeoff is number and size of files. Usually the distribution of a node module (that which is downloaded into node_modules) contains the source, documentation, distribution, tests, etc. In my current project, it adds up to 500MB already. They would do well to have an option to optimize dependencies for vendoring.
- progx 6y agoSo build your own npm?
- softawre 6y agoYou're right. We call this "vendoring" your dependencies. And it's a good way to do things.