Re:NPM packages with most dependencies
by drinchev on Wednesday February 07, 2018 @11:40AM
(#16325688)
No idea why this list is on the first page of HN, but it looks like ( at least the 10 that I clicked around ) are very spammy, not at all popular, packages that I doubt have any use.
Probably the attention to this article is the good old debate about npm and the huge dependencies that a package can have. Which is not always a bad thing. Actually I wrote an article [1] about it.
Re:NPM packages with most dependencies
by schneidmaster on Wednesday February 07, 2018 @11:43AM
(#16325731)
I don't think there's much meaningful information to glean from this list. The package at the top is literally just a package.json that installs all the packages published by one particularly prolific npm author, it doesn't have any serious purpose. Many of the other high-ranking packages simply have put their devDependencies in their dependencies, resulting in a bunch of babel plugins and the like (a mistake to be sure, but not indicative of anything in particular about the state of npm package usage).
Re:NPM packages with most dependencies
by imtringued on Thursday February 08, 2018 @06:07AM
(#16331429)
That package has no dependencies. The problem is when these one liner packages packages have dependencies and then in turn those dependencies have even more dependencies.
Re:NPM packages with most dependencies
by jeremejevs on Wednesday February 07, 2018 @12:12PM
(#16326026)
It is neither, devDependencies is a redundant distinction for projects where a module bundler is involved, like Webpack, since there's no scenario where you wouldn't want to pull these dependencies.
Re:NPM packages with most dependencies
by minitech on Wednesday February 07, 2018 @12:40PM
(#16326337)
These are packages published to npm. If you’re bundling all of your dependencies into your package with webpack before publishing it, they should all go in devDependencies, since someone installing the published package doesn’t need them.
Re:NPM packages with most dependencies
by jeremejevs on Thursday February 08, 2018 @05:06AM
(#16331234)
You are correct. Got too used to the "just add everything to regular dependencies" shortcut in private projects, which doesn't cut it for published modules.
Re:NPM packages with most dependencies
by tw1010 on Wednesday February 07, 2018 @11:42AM
(#16325713)
That's what I thought most people would think this would be about, based on the news cycle around this stuff (like leftpad). It's more a reflection on what the collective unconscious thinks about it, than an objective measure of the health of the ecosystem.
Re:NPM packages with most dependencies
by lev99 on Wednesday February 07, 2018 @11:32AM
(#16325594)
Having smaller packages each with many dependencies is a common node design pattern. I think this started because it doesn't have a lot of framework code to relay on, so simpler functions became packages.
It has advantages and disadvantages. People concerned about production uptime/deployment should keep copies of all dependencies on their network, and run npm against their network repo.
Re:NPM packages with most dependencies
by partycoder on Wednesday February 07, 2018 @12:16PM
(#16326070)
What I've learned from this is that npm itself has a lot of dependencies, and that is bad. It means any of those 500+ packages can take over npm itself for malicious purposes.
Other than that, there's not much to see. I would like this list being filtered by usage (e.g: installs/downloads). Some packages seem to be there for personal use.
Probably the attention to this article is the good old debate about npm and the huge dependencies that a package can have. Which is not always a bad thing. Actually I wrote an article [1] about it.
1 : http://www.drinchev.com/blog/increase-your-dependencies/
In case you don't know, lots of those packages are one liners.
ex: https://github.com/sindresorhus/array-uniq/blob/master/index...
> This package represents the top 500 dependencies on npm according to https://www.npmjs.com/browse/depended.
https://hackernoon.com/im-harvesting-credit-card-numbers-and...
It has advantages and disadvantages. People concerned about production uptime/deployment should keep copies of all dependencies on their network, and run npm against their network repo.
Other than that, there's not much to see. I would like this list being filtered by usage (e.g: installs/downloads). Some packages seem to be there for personal use.
Don't force it. Use larger hammer.
Don't panic just throw more dependencies