Hacker News Reader

Comment by schneidmaster | Hacker News Reader

I don't think there's much meaningful information to glean from this list. The package at the top is literally just a package.json that installs all the packages published by one particularly prolific npm author, it doesn't have any serious purpose. Many of the other high-ranking packages simply have put their devDependencies in their dependencies, resulting in a bunch of babel plugins and the like (a mistake to be sure, but not indicative of anything in particular about the state of npm package usage).

View on HN

he package at the top is literally just a package.json that installs all the packages published by one particularly prolific npm author

In case you don't know, lots of those packages are one liners.

ex: https://github.com/sindresorhus/array-uniq/blob/master/index...

There’s history behind those one-liners: https://github.com/sindresorhus/array-uniq/commit/fb96562015...

That package has no dependencies. The problem is when these one liner packages packages have dependencies and then in turn those dependencies have even more dependencies.

Multiple packages on this list are like that first one. big-bertha is literally just the top 500 dependencies on npm:

> This package represents the top 500 dependencies on npm according to https://www.npmjs.com/browse/depended.

It is not a mistake, it is an error.

It is neither, devDependencies is a redundant distinction for projects where a module bundler is involved, like Webpack, since there's no scenario where you wouldn't want to pull these dependencies.

These are packages published to npm. If you’re bundling all of your dependencies into your package with webpack before publishing it, they should all go in devDependencies, since someone installing the published package doesn’t need them.

You are correct. Got too used to the "just add everything to regular dependencies" shortcut in private projects, which doesn't cut it for published modules.

Reply on news.ycombinator.com