4 ms·
Dependency management is an unrelated issue and it exists for any platform. Unless you copy paste code or unless you just avoid dependencies. Which is easy to d
by quonn 3y ago
Dependency management is an unrelated issue and it exists for any platform. Unless you copy paste code or unless you just avoid dependencies. Which is easy to do in TypeScript as well. Nobody says you need to install hundreds of packages.
- jacobyoder 3y ago> Nobody says you need to install hundreds of packages. If I need one, I have to get that package's dependencies. People don't choose to say "Damn, I'd really love to have 1800 dependencies!" But if you have 4-5, you automatically get dozens or hundreds out of your control. Yes, could you build everything yourself by hand? Sure. That's a hard sell to many depts/projects. "This will take 3 weeks to build" vs "This will take 4 minutes to npm install". That 4 minutes is introducing a lot of potential risk and headache and time later, but it's providing immediate relief. FWIW, "dependency management" is a problem in every platform, but I have nowhere near the same number of issues in the composer/php world (nor previously in the maven/java world) as I do in the npm/js world.
- cryptonym 3y agoPublishing & importing 3rd party code is so easy with npm that everyone is blindly importing code that wouldn't pass their own peer reviews.
- stiiv 3y agoAgreed! For this reason, we use very few third-party dependencies in our big TS monorepo. NPM is a jungle, and for an experienced team of TS developers, a new dependency just isn't worth the risk -- we'd rather just code things ourselves. But it is worth emphasizing that NPM really does stand out as a hazard compared to package repositories for other dev ecosystems. I believe that dangers are more common, and unpleasant outcomes can be more severe.