4 ms·
How does Bun avoid this? Or is it more that Bun provides things that you'd otherwise need a dependency for (eg: websockets)?
by Defletter 11mo ago
How does Bun avoid this? Or is it more that Bun provides things that you'd otherwise need a dependency for (eg: websockets)?
- lioeters 11mo agoFrom a link mentioned elsewhere in the thread: > Unlike other npm clients, Bun does not execute arbitrary lifecycle scripts for installed dependencies, such as `postinstall` and `node-gyp` builds. These scripts represent a potential security risk, as they can execute arbitrary code on your machine. https://bun.com/docs/guides/install/trusted https://bun.com/docs/guides/install/trusted I've also found the Bun standard library is a nice curated set of features that reduces dependencies.
- Defletter 11mo agoHmmm, it still has a pretty extensive default list of permitted npm packages, which wouldn't necessarily be a problem if there were a way to disable it, but I can't seem to find it.
- nektro 11mo agothe latter is what i was getting at yeah. updated list of standard library-esque functions implemented in native code so the need to reach to npm for a dependency happens far less often.