| ▲ | karel-3d 4 hours ago | |
There is a guy (ljharb) who is literally on TC39 - JavaScript specification committee - who is maintaining like 600 packages full of polyfills/dependencies/utilities. It's just javascript being javascript. | ||
| ▲ | Sammi 3 hours ago | parent | next [-] | |
There was a huge uproar about that guy specifically and deep dependency graphs in general a year ago. A lot has already changed for lots of the popular frameworks and libraries. Dependency graphs are already much slimmer. The cultural change is happening, but we can't expect it to happen all at once. | ||
| ▲ | bapak an hour ago | parent | prev | next [-] | |
Irrelevant here. You use eslint-plugin-import with its 60 dependencies; One dependency or 60 is irrelevant because you only need one token: his. They're all his packages. The problem with that guy is that the dependencies are useless to everyone except his ego. | ||
| ▲ | imtringued an hour ago | parent | prev [-] | |
That wouldn't be a problem if there was proper package signing and the polyfill packages were hosted under a package namespace owned by the javascript specification committee. | ||