3 ms·
Vendoring saves dependency-hosts a buttload on bandwidth costs too. And makes you resilient against their outages. And any future shenanigans on your current de
by Groxx 2y ago
Vendoring saves dependency-hosts a buttload on bandwidth costs too. And makes you resilient against their outages. And any future shenanigans on your current dependencies, either for cost or code injection.
Vendor everything. It's better for everyone except your code host, which is easily changed if necessary.
- viraptor 2y agoYou don't have to vendor for that. You can also setup a transparent proxy which will save all the dependencies you use in a "private repo". And if you update deps often, it will save a lot of space.
- Groxx 2y agoEntirely possible, but there's ample evidence that GIGANTIC amounts of people/projects/etc do not do that. Probably because everyone has to configure and run new opaque blobs of software per language / package system / etc. Vendoring (generally) means it's already on disk and needs no config or separate processes to take advantage of. It's nearly foolproof.
- viraptor 2y agoPeople also don't generally vendor. Just saying it's an option - there's too many "vendor everything" voices around. I've got a 4.4GB repo which says "please don't, that was a bad idea".