News for hackers. Stuff that matters.

A comment on Show HN: S3mini – Tiny and fast S3-compatible client, no-deps, edge-ready. Parent comment

Re:Show HN: S3mini – Tiny and fast S3-compatible client, no-... by greener_grass on Wednesday June 11, 2025 @10:29AM (#44248006)
The S3 packages on NPM are maintained by AWS
[ Parent | on HN ]
Re:Show HN: S3mini – Tiny and fast S3-compatible client, no-... by pier25 on Wednesday June 11, 2025 @10:52AM (#44248286)
Indeed but I was arguing about a general point.

I'd be surprised if any of your Node projects had less than 100 total deps of which a large number will be maintained by a single person.

See Express for example. 66 total deps with 26 deps relying on a single maintainer.

https://npmgraph.js.org/?q=express

But even in the case of the official aws-sdk they recently deprecated v2. I now need to update all my not-so-old Node projects to work with the newer version. Probably wouldn't have happened if I had used Bun's S3 client.

[ Parent | on HN ]
Re:Show HN: S3mini – Tiny and fast S3-compatible client, no-... by greener_grass on Wednesday June 11, 2025 @12:35PM (#44249321)
So let's put every package under the sun into the client?

This approach does not scale. We should make NPM better.

[ Parent | on HN ]
Re:Show HN: S3mini – Tiny and fast S3-compatible client, no-... by pier25 on Wednesday June 11, 2025 @02:02PM (#44250156)
How do you make NPM better?

BTW I'm not saying we should kill NPM. What I'm saying is we should reduce our dependance on random packages.

Bun doesn't need to add everything into the core engine. Eg: when using .NET you still add plenty of official Microsoft dependencies from Nuget.

[ Parent | on HN ]
Re:Show HN: S3mini – Tiny and fast S3-compatible client, no-... by greener_grass on Thursday June 12, 2025 @12:07PM (#44259328)
- NPM could migrate to reproducible builds of artefacts

- Trust could be opt-in by default

- Dependency installation could be made fully reproducible

[ Parent | on HN ]