Re:Polyfill supply chain attack hits 100K+ sites
by PaulHoule on Tuesday June 25, 2024 @04:12PM
(#40793047)
One argument is that Javascript-in-the-browser has advanced a lot and there's less need for a build system. (ex. ESM module in the browser)
I have some side projects that are mainly HTMX-based with some usage of libraries like D3.js and a small amount of hand-written Javascript. I don't feel that bad about using unpkg because I include signatures for my dependencies.
Re:Polyfill supply chain attack hits 100K+ sites
by spankalee on Tuesday June 25, 2024 @04:18PM
(#40793108)
npm is a package manager though, not a build system. If you use a library that has a dependency on another library, npm downloads the right version for you.
Re:Polyfill supply chain attack hits 100K+ sites
by josephg on Tuesday June 25, 2024 @04:45PM
(#40793382)
Yep. And so does unpkg. If you’re using JavaScript code through unpkg, you’re still using npm and your code is still bundled. You’re just getting someone else to do it, at a cost of introducing a 3rd party dependency.
I guess if your problem with npm and bundlers is you don’t want to run those programs, fine? I just don’t really understand what you gain from avoiding running bundlers on your local computer.
Re:Polyfill supply chain attack hits 100K+ sites
by simonw on Tuesday June 25, 2024 @06:06PM
(#40794215)
Before ESM I wasn't nearly as sold on skipping the build step, but now it feels like there's a much nicer browser native way of handling dependencies, if only I can get the files in the right shape!
The Rails community are leaning into this heavily now: https://github.com/rails/importmap-rails
I personally never want to go back to the pre-package-manager days for any language.