3 ms·
If you upgrade regularly, maintain sufficient business-logic testing to catch breakage, and regularly audit your dependencies for those which are no longer main
by solatic 3y ago
If you upgrade regularly, maintain sufficient business-logic testing to catch breakage, and regularly audit your dependencies for those which are no longer maintained so that they can be ripped out and replaced with maintained alternatives, then you're fine.
If you skip any one of those, then your full-time job is longer about shipping features/value but just trying to get the damned thing to work.
- subtra3t 3y agoI think doing just a few of your stated precautions would be more than enough to provide sufficient reason to hate dependencies
- timrichard 3y agoOut of interest, I just pasted a package.json into ChatGPT and asked if any dependencies were deprecated or no longer maintained. The results looked promising, but there seems to be a cap on the time it can spend browsing. So perhaps it could be done in chunks, or maybe the API version doesn't have the same restriction (I haven't tried it). I also tried prompting to ask if any dependencies have been eclipsed by more popular libraries, which seemed to produce results. Might be worth experimenting to see if it can take some grunt work out of it. Or an automated report as a CI stage. Hmm.
- subtra3t 3y agoI'd imagine many people would be willing to pay for such a product.
- prmph 3y agoAnd what is the guarantee that a no-longer-maintained dependency will have a suitable and exact alternative? Also, tests catching breakage doesn't solve the breakage, so regular upgrades can be quite time consuming, From my experience, dependencies introduce complexity in a super-linear manner, and one should be very careful in introducing them. This is a general principle that goes beyond NPM.