News for hackers. Stuff that matters.
Re:Node.js packages don't deserve trust by Vinnl on Monday April 11, 2022 @10:28AM (#30989225)
One potentially contributing factor is that npm makes it very easy to avoid conflicts with duplicate dependencies, i.e. if one dependency has a transitive version on some other package, and another dependency also has a transitive dependency on that package, but on an incompatible version, that's not a problem in npm: it'll just store both on your disk. That might remove some pressure to minimise the number of dependencies on library authors.

And of course, there are just far more people working on it, I believe.

Re:Node.js packages don't deserve trust by zkldi on Monday April 11, 2022 @10:53AM (#30989626)
This reduces package-installing friction, but this is a good thing anyway -- there's no reason why you shouldn't be able to use [email protected] and [email protected] in the same project. For all intents and purposes they're different packages, viz. the version is just as important as the package name.
Re:Node.js packages don't deserve trust by Vinnl on Monday April 11, 2022 @02:31PM (#30992757)
Yeah to be clear, I wasn't trying to say it was a bad feature, just that this might be one of the negative sides part of its trade-off.