4 ms·
> I mean, how is this that possible? The Node.JS library ecosystem (for better or worse) is modeled as small libraries which do only one thing, and often have
by jeswin 4y ago
> I mean, how is this that possible?
The Node.JS library ecosystem (for better or worse) is modeled as small libraries which do only one thing, and often have dozens of dependencies. And those in turn, have their own dependencies.
So when you import a library, you're bringing in a lot of other libraries as well. Some large companies have stringent audits (for licenses etc), but most care (or are aware) only about the library they imported. core-js is probably a dependency for many others, and especially transpiler toolchains which are common in JS.
- kypro 4y agoI completely understand this reasoning for smaller companies, but a company like Spotify will care deeply about the dependencies in their project. Just because core-js is a dependency of a dependency simply doesn't matter and if anything, makes it even more essential. Unless they're extremely incompetent, any 3rd party code that's to be deployed to their entire user base is presumably being reviewed in detail. And I guess I'm not even sure I buy the argument that most developers don't know about core-js. I know I'd be extremely concerned if I was hiring an experienced frontend dev who didn't know what core-js was. Anyone who's thought about browser capability before should have had to think about polyfills, and naturally their use of core-js. It also comes up a lot when trying to optimise bundle size given the size of core-js.
- sokoloff 4y agoYour estimate of the competence and thoroughness of various actors in this industry is significantly higher than mine.