5 ms·
PackagePhobia – Find the cost of adding a new dev dependency to your project
- cebert 2y agoI appreciate the concept, but there are additional costs that would be great to consider. How frequently do you need to parch the package to address CVEs? How many downstream dependencies does this package have? How often do they make breaking changes?
- mubou 2y agoI like how the graph shows the change in size per version. "Publish size" is a little misleading though. I thought that meant the size that would be included in my bundle when I publish my app, and was wondering how you were calculating that. Maybe "w/ deps" "w/o deps"? I'd appreciate you not hiding information below the fold. Really hate that design trend. Remove the `min-height: 100vh` and see how much better it looks (with a bit of padding). At least make it 90vh.
- styfle 2y agoThe word "publish" is from "npm publish" and I don't think there is a better term to switch to. https://docs.npmjs.com/cli/v8/commands/npm-publish https://docs.npmjs.com/cli/v8/commands/npm-publish I like your idea about showing the information below the fold so I fixed it, thanks! https://github.com/styfle/packagephobia/pull/1069 https://github.com/styfle/packagephobia/pull/1069
- imoreno 2y agoDoes anyone know something like this, but for other languages like Python?
- mrlatinos 2y agoI thought this was language agnostic. Should probably make it more clear that it's for JS.
- jensenbox 2y agoI agree 100% - this needs to be renamed if it is not agnostic.
- ycombinatornews 2y agoHow is this different from bundlephobia?
- styfle 2y agoSee the readme on github for a full comparison
- silverwind 2y agobundlephobia counts loaded code size, this counts total package size.
- stoicjumbotron 2y agoBased on this talk by TkDodo (TanStack Query maintainer): https://youtu.be/8-RTNnn9GR8?t=255 https://youtu.be/8-RTNnn9GR8?t=255 https://bundlejs.com/ https://bundlejs.com/ is the better alternative to check your dependency sizes with
- styfle 2y agoThey are orthogonal tools. Checkout the readme for a comparison against other tools. https://github.com/styfle/packagephobia https://github.com/styfle/packagephobia
- stoicjumbotron 2y agoAh got it! Thanks for the README
- spankalee 2y agoLooking at some packages that I maintain, I think the sizes might be off, but I'll have to dig in more later. I wonder if it's handing export conditions properly? We have browser, node, developer, and types exports. Are the files behind quadruple counted?
- styfle 2y agoIf you find a bug, please report the issue on GitHub and I’ll take a look, thanks!
- hsbauauvhabzb 2y agoIn what world does cost mean file size and not consider financial cost, patching, security auditing, debugging, and the cost of finally ripping it out when everyone agrees retrospectively that it was a mistake to include in the first place. Come to think of it, the shortcoming of the description explains a lot of things about the current state of the JavaScript ecosystem.
- deleted 2y ago[deleted]
- aragilar 2y agoI would have thought it would show how big the dependency tree was.
- fmajid 2y agoAnd a count of historical CVEs in its transitive graph.
- ChrisMarshallNY 2y agoCVEs might not be the best metric, alone. Many large, mature, and solid packages could have long histories of resolved CVEs.
- hsbauauvhabzb 2y agoYes but that would indicate deeply rooted issues in many cases.
- ChrisMarshallNY 2y agoI would say "might," as opposed to "would." Big systems have big surfaces, no matter what quality they are. Dependency chains may be more of an issue. I think several of the last few big exploits have been compromises in fairly small packages, that were incorporated into larger ones. Then, there's the "Bro Coefficient." Who wrote the package should count for a lot. I'd trust a package written by "linus.torvalds," a lot more than one written by "L33tCoder420LOL," even if the Web site is super-sexy, and it has a gazillion GH stars.
- worthless-trash 2y agoUseless, doesn't even know what glibc is.
- radicalriddler 2y agoThey says sponsored by Vercel and Upstash, but in the repo, it just says hosting and database "sponsored" by them. Are they just using the free tier???
- radicalriddler 2y agoFrankly bundlephobia gives me more information that I care about... "How much is the end user going to have to download, parse and execute".
- styfle 2y agoBoth offer a free plan but Package Phobia is sponsored meaning its on the paid plan but getting it for free. Kinda like a skateboarder might be sponsored and get a skateboard for free even though others pay for the same item. Package Phobia started out on the free plan but it turns out its quite popular, serving over 5 million requests per month. A cache miss (which is frequent given the cardinality of packages + versions), it can take 30 seconds to install a package and measure its size. There's also a public API which tools like Socket use to check the size of every npm package. https://x.com/styfle/status/1826296197566644497 https://x.com/styfle/status/1826296197566644497
- pcthrowaway 2y agoThis is somehow slower and worse than bundlephobia. Was bundlephobia an improvement on this concept or is packagephobia just a cheap knockoff?
- styfle 2y agoSee this issue: https://github.com/pastelsky/bundlephobia/issues/40 https://github.com/pastelsky/bundlephobia/issues/40
- styfle 2y agoWhat a surprise! I’m the author of Package Phobia and it’s been largely unchanged since 2018. If you’re looking for more details, checkout the readme on GitHub. Let me know if you have questions, thanks! https://github.com/styfle/packagephobia https://github.com/styfle/packagephobia
- pier25 2y agoI prefer https://pkg-size.dev/ https://pkg-size.dev/
- zarazas 2y agoTried uploading my package.json, but I got a 404, because of a local package, which is part of my monorepo. Would be good if it would ignore dependencies, where the version is: `"workspace:^"`