Hacker News Reader

Comment by naranha | Hacker News Reader

Maven is a pretty horrible dependency manager. I would take NPM over it any day, because it is so much simpler. There is much less that can go wrong, while with maven you're fighting with the tooling all the time. pom.xml files are much larger than package.json files. While I can read and understand a package.json no problemo in a couple of seconds, with pom.xml files I'm completely lost for hours on end, even when I wrote them myself a while ago.

View on HN

I'd say Maven is more than a dependency manager, though. It's a full build manager, with dependency management as one (major) feature. The dependency management part itself isn't very complicated, other than the verbosity of XML as the structure.

I have spent a long time as a Java dev using Maven, and the past few years floating around some other projects (C#, PHP, Python, a tiny bit of NodeJS) and continually find myself wishing to have Maven back, so I suppose YMMV.

Ironically though, every time I start a new project with maven, I end up needing to google how to actually build a runnable thing. I end up needing to configure some kind of maven plugin to build a fat jar.

Why did I include this package B? Oh it addresses a security concern from a dependency of this other package A. Hope you put a comment there. Wait, there's a security issue with B also? Add another package C to deal with the security issue in B. That's just 1 aspect.

Now let's munge in plugins and plugins of packages and it gets messy real fast. Outside of the outdated XML, is there a way to deal with these problems cleanly?

> Maven is a pretty horrible dependency manager. I would take NPM over it any day

But Maven doesn't need a "lock" file, and can still download a reproducible tree of dependencies just fine, so that's a win in my book!

Quite the opposite, we had tons of issues with npm/package.json and none whatsoever with maven, which we can use for basically everything and it's super stable from release to another.

The problem is also that there's several dependency managers in the ecosystem. You end up learning them all badly because some piece is only available in one or the other.

I will literally rather download deps one by one by hand than use npm, it’s that bad.

maven predates NPM by probably 20 years. We've learned a lot about dependency managers collectively in that time. I'm sure if maven were rewritten today, it would be different.

Six years; 2004 vs 2010.

NPM changed its model (more like fixed) several times during the few years it existed. They hardly learn anything.

Reply on news.ycombinator.com