I'm not buying the narrative of "js dependency hell what are they thinking" anymore.
Try installing a package for Rust. Or Go. Or ... any language, really.
Try installing a package for Rust. Or Go. Or ... any language, really.
The largest, and not exactly admirable, I can find is reqwest that drags in 97.
Whilst 100 is a huge number... It's an enormous gap from the many thousands.
I have a project I haven't even started yet in Rust. Three dependencies in Cargo.toml. They download and install 34 dependencies.
I've now added three more (from kube-rs readme). It's now 197 dependencies. And so on.
I have a small project that I work on from time to time which uses 5 libraries (react, a map library and a chart library), typescript, and react-scripts (which I guess pulls in webpack and all the rest).
This is what happens when I run a npm audit (I havent' touched it for a couple of months)
> found 38934 vulnerabilities (38916 low, 18 moderate) in 906346 scanned packages
> run `npm audit fix` to fix 38620 of them.
> 314 vulnerabilities require manual review. See the full report for details.
While the real numbers are probably lower because there is a lot of duplication inside the node_modules folder, I find this ... astounding.
(1) in fact, seeing some of the worst kept me away from python for far too long until I realized plenty of python software doesn’t even need pypi and most only need it for a couple things with no transitive dependencies
There is perhaps a something about the JavaScript audience tending to attract less advanced implementers. So you end up with a lot of otherwise considered trivial and low-quality utilities being published and pulled down from the registry.
Rust and Go tend to be for more advanced scenarios where things like performance, security and support matters tremendously.
As I wrote in a sibling comment, I have a project I haven't even started yet in Rust [1]. And it's measly 6 dependencies pull a total of 197.
197 dependencies is too many to trust.