Diff being you usually have like five python deeps for every hundred npm deps a d you can do the old school thing and subscribe to the security alerts for those deps. The difference in number of deps means you have the cognitive space to understand them. Npm needed to automate because the numbers are too high. One of python’s old selling points was “Batteries included”. And the idea is fewer large library rather than a bunch of tiny libraries.

With a small number of deps where you skim the development DL, you know if there is a security issue or a cool new feature you want. Also it has more of the Unix C philosophy of don’t break stable APIs in new releases. So upgrading mostly just worked. (Stuff like deliberately breaking old SSL protocols aside). (Until python 3 of course.)

I got to pains to limit how many python external libraries I use, for all these reasons. But because Python is so capable on its own, it works.

Most languages I've used don't *need* to have 1000 dependencies like JS does.

They also don't have thousands of projects depending on ridiculous packages like left pad because they actually have a standard library.

The surface of vulnerabilities and the brittleness of the entire ecosystem is the bad thing, not the warnings.

> So npm gives you warnings about vulnerabilities and that's a bad thing?

> You notice you have thousands of outdated dependencies and that's a bad thing?

This is a weird reply considering that the OP literally said those were a good thing:

> Oh, `npm install`? You just found out you got like 1000+ vulnerabilities. Alright, good thing it told me actually, let me update.

The bad things are in the lines that follow.

Not OP but what I think they struggled with is fixing warnings. JS projects are like a poorly built house, things are constantly deteriorating and need constant maintenance.

I've got a new nodejs project that a colleague wrote about 6 months ago. It's already completely broken and needed a lot of effort to get working again.

On the other hand his php project from 2011 still works, just as my perl stuff from 2006 still just works.

This doesn't sound foreign to me. Node projects rely on a lot of dependencies (and so does their dependencies) so there is a lot of moving parts and it's prone to break.

> So npm gives you warnings about vulnerabilities and that's a bad thing?

> Alright, good thing it told me actually, let me update.