3 ms·

> The popular Javascript React framework has 15K direct and 2K indirect dependencies - https://deps.dev/npm/react/19.2.3 https://deps.dev/npm/react/19.2.3 You’

> The popular Javascript React framework has 15K direct and 2K indirect dependencies - https://deps.dev/npm/react/19.2.3 https://deps.dev/npm/react/19.2.3 You’re looking at the number of dependents. The React package has no dependencies. Asides: > Do you read the source of every single package before doing a `brew update` or `npm update`? Yes, some combination of doing that or delegating it to trusted parties is required. (The difficulty should inform dependency choices.) > What if these sources include binary packages? Reproducible builds, or don’t use those packages.

ashishb 9mo ago
> You’re looking at the number of dependents. The React package has no dependencies. Indeed. My apologies for misinterpreting the link that I posted. Consider "devDependencies" here https://github.com/facebook/react/blob/main/package.json https://github.com/facebook/react/blob/main/package.json As far as I know, these 100+ dev dependencies are installed by default. Yes, you can probably avoid it, but it will likely break something during the build process, and most people just stick to the default anyway. > Reproducible builds, or don’t use those packages. A lot of things are not reproducible/hermetic builds. Even GitHub Actions is not reproducible https://nesbitt.io/2025/12/06/github-actions-package-manager.html https://nesbitt.io/2025/12/06/github-actions-package-manager... Most frontend frameworks are not reproducible either. > don’t use those packages. And do what?
- nicoburns 9mo ago
  > As far as I know, these 100+ dev dependencies are installed by default. devDependencies should only be installed if you're developing the React library itself. They won't be installed if you just depend on React.
  - ashishb 9mo ago
    > They won't be installed if you just depend on React. Please correct me if I am wrong, here's my understanding. "npm install installs both dependencies and dev-dependencies unless NODE_ENV is set to production."
    - sponnath 9mo ago
      It does not recursively install dev-dependencies.
      - ashishb 9mo ago
        > It does not recursively install dev-dependencies. So, these ~100 [direct] dev dependencies are installed by anyone who does `npm install react`, right?
        frio 9mo ago
        No. They’re only installed if you git clone react and npm install inside your clone. They are only installed for the topmost package (the one you are working on), npm does not recurse through all your dependencies and install their devDependencies.
        SkiFire13 9mo ago
        > ~100 [direct] When you do `npm install react` the direct dependency is `react`. All of react's dependencies are indirect.
    - rafram 9mo ago
      Run `npm install react` and see how many packages it says it added. (One.)
  - remexre 9mo ago
    If you're trying to audit React, don't you either need to audit its build artifacts rather than its source, or audit those dev dependencies too?
- timcobb 9mo ago
  > And do what? Keep on keepin on
  - cindyllm 9mo ago
    [dead]

ashishb 9mo ago

> You’re looking at the number of dependents. The React package has no dependencies. Indeed. My apologies for misinterpreting the link that I posted. Consider "devDependencies" here https://github.com/facebook/react/blob/main/package.json https://github.com/facebook/react/blob/main/package.json As far as I know, these 100+ dev dependencies are installed by default. Yes, you can probably avoid it, but it will likely break something during the build process, and most people just stick to the default anyway. > Reproducible builds, or don’t use those packages. A lot of things are not reproducible/hermetic builds. Even GitHub Actions is not reproducible https://nesbitt.io/2025/12/06/github-actions-package-manager.html https://nesbitt.io/2025/12/06/github-actions-package-manager... Most frontend frameworks are not reproducible either. > don’t use those packages. And do what?

nicoburns 9mo ago
> As far as I know, these 100+ dev dependencies are installed by default. devDependencies should only be installed if you're developing the React library itself. They won't be installed if you just depend on React.
- ashishb 9mo ago
  > They won't be installed if you just depend on React. Please correct me if I am wrong, here's my understanding. "npm install installs both dependencies and dev-dependencies unless NODE_ENV is set to production."
  - sponnath 9mo ago
    It does not recursively install dev-dependencies.
    - ashishb 9mo ago
      > It does not recursively install dev-dependencies. So, these ~100 [direct] dev dependencies are installed by anyone who does `npm install react`, right?
      - frio 9mo ago
        No. They’re only installed if you git clone react and npm install inside your clone. They are only installed for the topmost package (the one you are working on), npm does not recurse through all your dependencies and install their devDependencies.
      - SkiFire13 9mo ago
        > ~100 [direct] When you do `npm install react` the direct dependency is `react`. All of react's dependencies are indirect.
  - rafram 9mo ago
    Run `npm install react` and see how many packages it says it added. (One.)
- remexre 9mo ago
  If you're trying to audit React, don't you either need to audit its build artifacts rather than its source, or audit those dev dependencies too?
timcobb 9mo ago
> And do what? Keep on keepin on
- cindyllm 9mo ago
  [dead]