Hacker News Reader

Comment by mschuster91 | Hacker News Reader

brouhaha, this is why you should not put node_modules into .gitignore (same for PHP's composer.lock and vendor/ folder).

To be honest, I have waited for something like this to happen so that people finally wake up and realize how deeply and truly compromised the JS ecosystem really is. 11 SLOC not available any more and all over the internet builds are breaking etc.?!

And please, why isn't essential stuff like this in the JS standard string library?

View on HN

> brouhaha, this is why you should not put node_modules into .gitignore (same for PHP's composer.lock and vendor/ folder).

You should obviously not do that if you are writing a library. You shouldn't publish vendored modules on npm. If everybody did this everybody would end up fetching 100MB packages.

Not adding node_modules to .gitignore would be a very wrong way of solving this issue.

For a library yes, but if you're writing software you absolutely must. npm actually deduplicates and flattens your dependencies to reduce clutter.

Better, you should run your own NPM repository, which transparently caches packages from the main repository. Unfortunately, that's not nearly as easy with NPM as with (say) maven -- the only turn-key solution I'm aware of is Artifactory, and then only in the pro version, and configuring npm to use it is a bit awkward.

some node modules compile platform specific binaries

Ew yes, haven't thought of that, but the code that compiles said binaries usually can be re-run to recreate the binary.

Reply on news.ycombinator.com