4 ms·

The problem is really not as big as most commenters here make it out to be. With most modern bundlers, bundle size is rarely the problem anymore. NPM audit hel

The problem is really not as big as most commenters here make it out to be. With most modern bundlers, bundle size is rarely the problem anymore. NPM audit helps detecting and fixing security vulnerabilities of dependencies. And build process breaking because of dependencies is rather a sign of having a bad CI pipeline. I am not saying it is great to have many dependencies, but it's really not THAT bad.

remram 6y ago
Detecting and fixing problems after your app has been deployed is NO WHERE NEAR as good as avoiding problems. Not depending on thousands of packages from thousand of strangers is about avoiding problems.
- MoSattler 6y ago
  Obviously the measures are meant to be run before you deploy, not after. That's what a CI pipeline does.
  - remram 6y ago
    Auditing detect issues in published packages. You can't know ahead of time in your CI that an issue is going to be found in that package.
Sebb767 6y ago
The problem is really not the size or the number of files (both a pretty manageable by modern hardware), but that you execute mostly unverified code by several thousand people. It only takes one of those to go rogue to have your data siphoned, your drive encrypted ... you name it. Sure, big projects (hopefully!) watch their dependencies, but you auditing 13k packages is simply impossible. And, given how much these numbers explode, it unfortunately seems like people simply add a dependency without doing their due diligence.
- MoSattler 6y ago
  This is what `npm audit` is for. It's not perfect obviously, but it should prevent the worst. Besides, my guess is that the vast majority of developers do not verify their dependencies in the first place. No matter if it's number is 5 or 5000.
sk0g 6y ago
What is a good CI pipeline meant to do when dependencies aren't able to be pulled anymore, caching aside?
- speedgoose 6y ago
  Almost 100% of dependencies are hosted on npm. So the CI should fail and you wait for npm to fix the issue. In the unlikely scenario that npm it gone forever, you can still get the dependencies from a previous build or a random developer laptop, or Github. If you must build and deploy a version of your software while npm is down, which is unlikely but may happen, well you may have to skip the CI and build from a developer laptop.

remram 6y ago

Detecting and fixing problems after your app has been deployed is NO WHERE NEAR as good as avoiding problems. Not depending on thousands of packages from thousand of strangers is about avoiding problems.

MoSattler 6y ago
Obviously the measures are meant to be run before you deploy, not after. That's what a CI pipeline does.
- remram 6y ago
  Auditing detect issues in published packages. You can't know ahead of time in your CI that an issue is going to be found in that package.

Sebb767 6y ago

The problem is really not the size or the number of files (both a pretty manageable by modern hardware), but that you execute mostly unverified code by several thousand people. It only takes one of those to go rogue to have your data siphoned, your drive encrypted ... you name it. Sure, big projects (hopefully!) watch their dependencies, but you auditing 13k packages is simply impossible. And, given how much these numbers explode, it unfortunately seems like people simply add a dependency without doing their due diligence.

MoSattler 6y ago
This is what `npm audit` is for. It's not perfect obviously, but it should prevent the worst. Besides, my guess is that the vast majority of developers do not verify their dependencies in the first place. No matter if it's number is 5 or 5000.

sk0g 6y ago

What is a good CI pipeline meant to do when dependencies aren't able to be pulled anymore, caching aside?

speedgoose 6y ago
Almost 100% of dependencies are hosted on npm. So the CI should fail and you wait for npm to fix the issue. In the unlikely scenario that npm it gone forever, you can still get the dependencies from a previous build or a random developer laptop, or Github. If you must build and deploy a version of your software while npm is down, which is unlikely but may happen, well you may have to skip the CI and build from a developer laptop.