News for hackers. Stuff that matters.
Re:Polyfill supply chain attack hits 100K+ sites by simonw on Tuesday June 25, 2024 @03:54PM (#40792843)
Yes! Love that about Lit. The problem is when I want to add other things that have their own dependency graph.
Re:Polyfill supply chain attack hits 100K+ sites by spankalee on Tuesday June 25, 2024 @03:59PM (#40792913)
This is why I don't think it's very workable to avoid npm. It's the package manager of the ecosystem, and performs the job of downloading dependencies well.

I personally never want to go back to the pre-package-manager days for any language.

Re:Polyfill supply chain attack hits 100K+ sites by PaulHoule on Tuesday June 25, 2024 @04:12PM (#40793047)
One argument is that Javascript-in-the-browser has advanced a lot and there's less need for a build system. (ex. ESM module in the browser)

I have some side projects that are mainly HTMX-based with some usage of libraries like D3.js and a small amount of hand-written Javascript. I don't feel that bad about using unpkg because I include signatures for my dependencies.

Re:Polyfill supply chain attack hits 100K+ sites by spankalee on Tuesday June 25, 2024 @04:18PM (#40793108)
npm is a package manager though, not a build system. If you use a library that has a dependency on another library, npm downloads the right version for you.
Re:Polyfill supply chain attack hits 100K+ sites by josephg on Tuesday June 25, 2024 @04:45PM (#40793382)
Yep. And so does unpkg. If you’re using JavaScript code through unpkg, you’re still using npm and your code is still bundled. You’re just getting someone else to do it, at a cost of introducing a 3rd party dependency.

I guess if your problem with npm and bundlers is you don’t want to run those programs, fine? I just don’t really understand what you gain from avoiding running bundlers on your local computer.

Re:Polyfill supply chain attack hits 100K+ sites by simonw on Tuesday June 25, 2024 @06:06PM (#40794215)
Before ESM I wasn't nearly as sold on skipping the build step, but now it feels like there's a much nicer browser native way of handling dependencies, if only I can get the files in the right shape!

The Rails community are leaning into this heavily now: https://github.com/rails/importmap-rails