News for hackers. Stuff that matters.
Re:Dozens of malicious PyPI packages discovered targeting de... by FractalHQ on Wednesday November 02, 2022 @09:34PM (#33445597)
I love this idea. But what about peer deps? And their dependencies? What if multiple deps share peer deps? Is there a simple way permissions could be resolved in the web of modules?

Also- tangential but I really wish people would stop using require and use ESM whenever possible. I cringe when I see `require` just as much as when I see `var` being used in 2022, but I’m not certain there’s never a good reason not to use ESM.

Re:Dozens of malicious PyPI packages discovered targeting de... by nirimda on Thursday November 03, 2022 @07:36AM (#33449548)
If you want to override the dependency of your dependency, then it's your dependency too - so if you were using the javascript approach up there you might have

    var bar = require("bar", {baz: loggingBaz})
    var foo = require("foo", {bar})
This is true even if you never otherwise use bar.

This is certainly how peer dependencies work in nix flakes, for instance, where you can say something like

   bar = //....
   bar.inputs.baz.follows = loggingBaz;
   foo = //....
   foo.inputs.bar.follows = bar;
Since nix flakes is a package/dependency manager, it generates a lockfile that you could inspect too see what all the dependencies are, and make sure you got it right (oh, I still have two bar's, I must have forgotten to override some other dep). I suppose any compiler that involves a linking stage would in principle be able to generate some comparable output at the language level.

(Apologies for using require and var, but I'm convinced the functional syntax is semantically clearer in this context.)