3 ms·
Dependencies is different from bundling. Javascript's dependency management is an absolute dream, and you can have a newbie up and running with a consistent env
by phailhaus 4y ago
Dependencies is different from bundling. Javascript's dependency management is an absolute dream, and you can have a newbie up and running with a consistent environment very quickly. Compare that to Python, which still doesn't have a declarative package manifest format (leading to extremely slow/inconsistent package resolution), or a mature "lockfile" for deterministic installs. npm has both of these out of the box. You can even assert what versions of npm or node you need in your package.json to make sure you're using known-working versions.
EDIT: Turns out Python just finalized a pyproject.toml format in 2021. Of course, this doesn't really help much until every package out there migrates. npm has used the package.json format pretty much since day one. And there is still no standard lockfile, other than dumping the output of `pip freeze`.
- wink 4y agoJust because Python's story here isn't good doesn't mean JS's is automatically good. Your environment may be consistent at this point in time but it's still a horrible mess.
- phailhaus 4y agoHow so? OP's gripes were mostly around bundling, but the dependency management in JS is pretty solid.
- plonk 4y ago> Compare that to Python, which still doesn't have a declarative package manifest format It does, with pyproject.toml [1]. It even had two [2], but setup.cfg is deprecated because it was specific to setuptools. [1] https://setuptools.pypa.io/en/latest/userguide/pyproject_config.html https://setuptools.pypa.io/en/latest/userguide/pyproject_con... [2] https://setuptools.pypa.io/en/latest/userguide/declarative_config.html https://setuptools.pypa.io/en/latest/userguide/declarative_c...
- isoprophlex 4y agoAbout the situation in python... Have you tried using "pip freeze > requirements.txt" to get a deterministic set of requirements? Or am I thinking too simplistic?
- phailhaus 4y agoYeah, that's unfortunately not good enough. Ideally, you want to store the graph of dependencies so that you can understand why each package is being installed, with useful metadata like the hash of package to ensure you're getting the same code.