2 ms·
The packages affected, like [1], literally say: > Experimental React Flight bindings for DOM using Webpack. > Use it at your own risk. 311,955 weekly downloa
by nine_k 11mo ago
The packages affected, like [1], literally say:
> Experimental React Flight bindings for DOM using Webpack.
> Use it at your own risk.
311,955 weekly downloads though :-|
[1]: https://www.npmjs.com/package/react-server-dom-webpack https://www.npmjs.com/package/react-server-dom-webpack
- ascorbic 11mo agoThat number is misleadingly low, because it doesn't include Next.js which bundles the dependency. Almost all usage in the wild will be Next.js, plus a few using the experimental React Router support.
- root_axis 11mo agoAs far as I'm aware, transitive dependencies are counted in this number. So when you npm install next.js, the download count for everything in its dependency tree gets incremented. Beyond that, I think there is good reason to believe that the number is inflated due to automated downloads from things like CI pipelines, where hundreds or thousands of downloads might only represent a single instance in the wild.
- korm 11mo agoIt's not a transitive dependency, it's just literally bundled into nextjs, I'm guessing to avoid issues with fragile builds.
- swyx 11mo agowhy is it not normal for CI pipelines to cache these things? its a huge waste of compute and network.
- FINDarkside 11mo agoIt's certainly not uncommon to cache deps in CI. But at least at some point CircleCI was so slow at saving+restoring cache that it was actually faster to just download all the deps. Generally speaking for small/medium projects installing all deps is very fast and bandwidth is basically free, so it's natural many projects don't cache any of it.
- odie5533 11mo agoThese often do get cached at CDNs inside of the consuming data centers. Even the ISP will cache these kind of things too.