Re:NPM – "is-even", 160k weekly downloads
by phist_mcgee on Tuesday November 16, 2021 @01:58PM
(#29244872)
Don't forget too that npm by default allows minor version upgrades with the ^ prefix for version numbers, which means that unless you properly lock your dependencies, you can reintroduce changes over time, just by running npm install.
There is a bit of a culture clash inside Javascript. Even when you're a veteran contributor, sometimes maintainers resist changing packages, as simple as they are, because there is an implicit assumption that popular packages, or even packages with too many dependencies are "better" or "handled all the edge cases".
Even with careful evaluation of the options and a write-down of issues and a proper comparison, you need ten times as much energy to remove a package than it took to add it.
It's even worse is when "too many packages" is in the DNA of the package you're collaborating.