2 ms·
Your policy wouldn't change anything here. The person made thousands of modules that look like `@everything/sub-chunk-{id}`, each depending on N modules. Those
by hombre_fatal 3y ago
Your policy wouldn't change anything here.
The person made thousands of modules that look like `@everything/sub-chunk-{id}`, each depending on N modules. Those sub-chunk modules, together, depend on all NPM modules. Whatever upper limit you come up with, anyone can do this by setting N to your upper limit.
The problem here isn't that you can create modules that depend on other modules. If there's a problem at all, it's that the NPM's yank policy could be improved.
- vitiral 3y agoMy suggestion was for N=recursive deps (dependency TREE), so yes it would affect the "everything" package, and likely many of its chunks And I agree about yank! I just think you could implement multiple reasonable solutions here
- hombre_fatal 3y agoIt would affect the everything package, but not the issue since the issue is caused by npm's policy + simply creating thousands packages with, say, 5 dependencies that cover all of the module space. That they rolled all of those submodules into one big everything package is just a gimmick, not a source of the problem.