Is htmx Just Another JavaScript Framework?

Re:Is htmx Just Another JavaScript Framework? by gofreddygo on Thursday January 11, 2024 @12:00PM (#38954942)

Lockfiles aren't a magic bullet. They point to an a specific old version of all internal dependencies. That still requires the maintainer of each of my dependencies to have published a patch to an OLD version when vulns show up.

And the alternative of typscript + react + nodejs + npm + docker for a damn web based UI is just terrible ! Sorry, no bueno.

I don't want to be at the mercy of all the maintainers of my dependencies. So clearly, I need to cut down on my dependencies. htmx is a great middle ground. Clearly, you can now at least see the appeal of htmx + a backend service for a robust though not fully optimized web based app.

And I can't see the JS ecosystem's last 10 years as outright "progress", but rather a series of experiments, that work for some and don't for others.

[ Parent | on HN ]

Re:Is htmx Just Another JavaScript Framework? by quonn on Thursday January 11, 2024 @12:07PM (#38955081)

Many of these libraries cannot have meaningful vulnerabilities. What‘s a possible vulnerability in lodash that can be exploited without already being able to inject code?

Furthermore, any vulnerability in a dependency could also exist in code written by myself or a team member. And then never get fixed or even found.

[ Parent | on HN ]