3 ms·

I would be very keen to know if there are any of these "full-stack" frameworks that don't depend on NPM, or more specifically built with Deno or vanilla JS in m

I would be very keen to know if there are any of these "full-stack" frameworks that don't depend on NPM, or more specifically built with Deno or vanilla JS in mind? It feels like (to me at least) that at this stage it is quite clear that using NPM is an anti-pattern that is best avoided if possible (security, requiring a "dev machine" with the right version of NPM installed etc, general bloat) I know that there is nanojsx (https://deno.land/x/nano_jsx https://deno.land/x/nano_jsx) but would be keen to know of any other examples that anyone knows of?

_fat_santa 5y ago
> It feels like (to me at least) that at this stage it is quite clear that using NPM is an anti-pattern that is best avoided if possible (security, requiring a "dev machine" with the right version of NPM installed etc, general bloat) For all it's problems, it's still is the killer feature that makes it easy to develop JS apps. The things you mentioned can be mitigated with proper practices. 1. Security: Supply chain attacks can be mitigated through being deliberate about versions and making sure your CI systems always install a "frozen lockfile" 2. Requiring the "right" version of NPM: Can be easily solved through "engines" in package.json. You can basically tell your project to not run unless the dev has the right version of NPM. This is not that big of a deal since a dev can just install the correct version with npm. You can take this a step further with yarn and pin a specific binary in your project so it doesn't matter what version your devs are running, they will automatically use the binary you specified inside the project. 3. Performance and Bloat: Besides NPM, there's also Yarn and PNPM (Performance NPM) that both work much faster than NPM and are fully interoperable with existing package.json's. The ecosystem is still not perfect and security is still the biggest issue. The other issues you mentioned though can be easily mitigated through good practices.

_fat_santa 5y ago

> It feels like (to me at least) that at this stage it is quite clear that using NPM is an anti-pattern that is best avoided if possible (security, requiring a "dev machine" with the right version of NPM installed etc, general bloat) For all it's problems, it's still is the killer feature that makes it easy to develop JS apps. The things you mentioned can be mitigated with proper practices. 1. Security: Supply chain attacks can be mitigated through being deliberate about versions and making sure your CI systems always install a "frozen lockfile" 2. Requiring the "right" version of NPM: Can be easily solved through "engines" in package.json. You can basically tell your project to not run unless the dev has the right version of NPM. This is not that big of a deal since a dev can just install the correct version with npm. You can take this a step further with yarn and pin a specific binary in your project so it doesn't matter what version your devs are running, they will automatically use the binary you specified inside the project. 3. Performance and Bloat: Besides NPM, there's also Yarn and PNPM (Performance NPM) that both work much faster than NPM and are fully interoperable with existing package.json's. The ecosystem is still not perfect and security is still the biggest issue. The other issues you mentioned though can be easily mitigated through good practices.