News for hackers. Stuff that matters.
Re:Node.js packages don't deserve trust by derefr on Monday April 11, 2022 @10:17AM (#30989056)
> Once you've got enough versions of enough libraries that A and B both need C but at different versions, you start to need curation

Node specifically doesn’t have this constraint, though, as A’s C and B’s C can be loaded independently into the same VM, each one hermetic and only visible to its parent. (This is probably half of why Node’s ecosystem became the way it did, now that I think about it; every other ecosystem hits increasing numbers of constraint-resolution conflict problems as dependency hierarchy depth increases, and so limits itself in hierarchy depth to avoid this.)

Re:Node.js packages don't deserve trust by zozbot234 on Monday April 11, 2022 @10:22AM (#30989145)
> Node specifically doesn’t have this constraint, though, as A’s C and B’s C can be loaded independently into the same VM, each one hermetic and only visible to its parent.

Rust can do this as well, though most version variation is handled via semver rules wrt. compatibility. I think this exact requirement led to some controversy in the Go community at some point? Though they should now have a module system that allows for this?

Re:Node.js packages don't deserve trust by regularfry on Monday April 11, 2022 @10:25AM (#30989175)
It's less of a problem, but it bites as soon as you need to pass a data structure from one C to the other. That's less frequent, but does happen.