← Back to context

Comment by hsbauauvhabzb

2 months ago

JavaScript does have some pretty insane dependency trees. Most other languages don’t have anywhere near that level of nestedness.

25 comments

hsbauauvhabzb

Reply
staminade  2 months ago

Don't they?

I just went to crates.io and picked a random newly updated crate, which happened to be pixelfix, which fixes transparent pixels in pngs.

It has six dependencies and hundreds of transient dependencies, may of which appear to be small and highly specific a la left-pad.

https://crates.io/crates/pixelfix/0.1.1/dependencies

Maybe this package isn't representative, but it feels pretty identical to the JS ecosystem.

  • koakuma-chan  2 months ago

    It depends on `image` which in turn depends on a number of crates to handle different file types. If you disable all `image` features, it only has like 5 dependencies left.

cxr  2 months ago

It's not possible for a language to have an insane dependency tree. That's an attribute of a codebase.

  • orbital-decay  2 months ago

    Modern programming languages don't exist in a vacuum, they are tied to the existing codebase and libraries.

    • kelnos  2 months ago

      Sort of, but I don't really buy this argument. Someone could go and write the "missing JS stdlib" library that has no dependencies of its own. They could adopt release policies that reduce the risk of successful supply chain attacks. Other people could depend on it and not suffer deep dependency trees.

      JS library authors in general could decide to write their own (or carefully copy-paste from libraries) utility functions for things rather than depend on a huge mess of packages. This isn't always a great path; obviously reinventing the wheel can come with its own problems.

      So yes, I'd agree that the ecosystem encourages JS/TS developers to make use of the existing set of libraries and packages with deep dependency trees, but no one is holding a gun to anyone's head. There are other ways to do it.

  • WD-42  2 months ago

    Maybe the language should have a standard library then.

    • skydhash  2 months ago

      C library is smaller than Node.js (you won’t have HTTP). What C have is much more respectable libraries. If you add libcurl or freetype to your project, it won’t pull the whole jungle with them.

      6 replies →

rixed  2 months ago

This makes little sense. Any popular language with a lax package management culture will have the exact same issue, this has nothing to do with JS itself. I'm actually doing JS quasi exclusively these days, but with a completely different tool chain, and feel totally unconcerned by any of these bi-weekly NPM scandals.