News for hackers. Stuff that matters.

A comment on Brave overhauled its Rust adblock engine with FlatBuffers, cutting memory 75%. Parent comment

Re:Brave overhauled its Rust adblock engine with FlatBuffers... by ashishb on Monday January 05, 2026 @07:44PM (#46507318)
> You’re looking at the number of dependents. The React package has no dependencies.

Indeed.

My apologies for misinterpreting the link that I posted.

Consider "devDependencies" here

https://github.com/facebook/react/blob/main/package.json

As far as I know, these 100+ dev dependencies are installed by default. Yes, you can probably avoid it, but it will likely break something during the build process, and most people just stick to the default anyway.

> Reproducible builds, or don’t use those packages.

A lot of things are not reproducible/hermetic builds. Even GitHub Actions is not reproducible https://nesbitt.io/2025/12/06/github-actions-package-manager...

Most frontend frameworks are not reproducible either.

> don’t use those packages.

And do what?

[ Parent | on HN ]
Re:Brave overhauled its Rust adblock engine with FlatBuffers... by nicoburns on Monday January 05, 2026 @07:55PM (#46507411)
> As far as I know, these 100+ dev dependencies are installed by default.

devDependencies should only be installed if you're developing the React library itself. They won't be installed if you just depend on React.

[ Parent | on HN ]
Re:Brave overhauled its Rust adblock engine with FlatBuffers... by ashishb on Monday January 05, 2026 @08:35PM (#46507704)
> They won't be installed if you just depend on React.

Please correct me if I am wrong, here's my understanding.

"npm install installs both dependencies and dev-dependencies unless NODE_ENV is set to production."

[ Parent | on HN ]
Re:Brave overhauled its Rust adblock engine with FlatBuffers... by sponnath on Monday January 05, 2026 @08:42PM (#46507746)
It does not recursively install dev-dependencies.
[ Parent | on HN ]
Re:Brave overhauled its Rust adblock engine with FlatBuffers... by ashishb on Monday January 05, 2026 @09:11PM (#46507911)
> It does not recursively install dev-dependencies.

So, these ~100 [direct] dev dependencies are installed by anyone who does `npm install react`, right?

[ Parent | on HN ]
Re:Brave overhauled its Rust adblock engine with FlatBuffers... by frio on Monday January 05, 2026 @09:17PM (#46507945)
No. They’re only installed if you git clone react and npm install inside your clone.

They are only installed for the topmost package (the one you are working on), npm does not recurse through all your dependencies and install their devDependencies.

[ Parent | on HN ]
Re:Brave overhauled its Rust adblock engine with FlatBuffers... by SkiFire13 on Tuesday January 06, 2026 @08:35AM (#46512031)
> ~100 [direct]

When you do `npm install react` the direct dependency is `react`. All of react's dependencies are indirect.

[ Parent | on HN ]
Re:Brave overhauled its Rust adblock engine with FlatBuffers... by rafram on Tuesday January 06, 2026 @10:54AM (#46513895)
Run `npm install react` and see how many packages it says it added. (One.)
[ Parent | on HN ]
Re:Brave overhauled its Rust adblock engine with FlatBuffers... by remexre on Tuesday January 06, 2026 @10:01AM (#46513111)
If you're trying to audit React, don't you either need to audit its build artifacts rather than its source, or audit those dev dependencies too?
[ Parent | on HN ]
Re:Brave overhauled its Rust adblock engine with FlatBuffers... by timcobb on Monday January 05, 2026 @09:18PM (#46507954)
> And do what?

Keep on keepin on

[ Parent | on HN ]