3 ms·
I am a maintainer of Chalk (Javascript library for outputting color codes for terminals). We consider chalk 'finished' and probably won't release another major
by junon 4y ago
I am a maintainer of Chalk (Javascript library for outputting color codes for terminals).
We consider chalk 'finished' and probably won't release another major version that changes the API - perhaps just typescript maintenance as Microsoft messes with the language even further and we have to fix types.
Sometimes, software is complete. I hate this new industry dogma that code rots over time and needs to constantly be evolving in order to be "alive".
- JoeOfTexas 4y agoI think when a project heavily depends on dependencies it is easy for security issues to make it too risky. Lately, I've been seeing more and more npm packages that keep "extending" a dependency to add more features, which eventually gets abandoned. I'll use this package, multer-s3-transform, as an example. Its been abandoned. It depends on multer-s3, which depends on AWS-SDK and multer, which then depends on busboy. Now, AWS-SDK, Multer, and Busboy have organizations maintaining them. However, the random projects overlayed on top of those are by single individuals. The answer is to two-fold. Avoid overlayed projects and avoid big projects managed by a single individual.
- junon 4y agoChalk has no dependencies aside from those vendored into the source tree.
- JoeOfTexas 4y agoI took a quick look at Chalk. I would say using yoctodelay dependency is kinda useless, and is maintained by a single individual. I sense potential danger there. The other dev dependencies should be audited too.
- junon 4y agoSo? They're dev dependencies. They're not needed to actually use the code.