4 ms·
Right, but his point about that was essentially: "Why depend on that as a dependency rather than just have a copy directly in my project that I know will never
by entropicdrifter 6y ago
Right, but his point about that was essentially:
"Why depend on that as a dependency rather than just have a copy directly in my project that I know will never behave any differently?"
- speedgoose 6y agoBecause it's one line to a dependency with a name, a documentation, a bug tracker, many users, and that could be improved in the future. If you are scared about packages behaving differently, you should know that npm has lock files that describes your full dependency tree with versions and checksums.
- majormajor 6y ago"Could be improved in the future" is a risk when it comes to a simple utility function that does a simple thing that you don't want to change. In the same way that someone constantly tweaking your utility functions in your own project would be a risk - and you'd understandably want to code review all that - the more you choose to (or have to) outsource "trivial" stuff, the more brittle your project is.
- ioseph 6y agoHence the lockfile, on the flipside if you've copy and pasted source across which contains a security update you'll most likely not realise