Hacker News Reader

Comment by jwcooper | Hacker News Reader

This is such an odd argument. As a developer that likes to produce usable products, 'easy' is something I'm always looking for. Why not? Just because something is 'easy' doesn't mean it's inadequate. It all depends on what you're building.

Also, your misguided rant against node and npm rather hurts your credibility. Your argument was at least ok up until that point.

View on HN

I'm sorry, it is over the top, I'm just so tired of npm libraries I depend on going dark or changing things without updating the version.

FIY, npm does not allow you to push a module version more than once.

Pretty sure dependencies can come straight from a git url, bypassing npm. Put something on npm, and in your package.json you can depend on something straight up from github. npm will install and build that and it may break your stuff, it's a gamble. Given how dependencies nest into a massive web, you don't have to use many things before you end up with something that breaks you.

I think you're looking for npm shrinkwrap:

https://npmjs.org/doc/cli/npm-shrinkwrap.html

It locks in all dependencies, including dependencies of dependencies, and turtles all the way down.

shrinkwrap just locks down a version of a dependency, if the dependency points to a git master branch, that's not locked down. shrinkwrap doesn't install any code. I think his point is valid, although also probably still very rare.

npm will translate the git branch to its commit sha when you `npm shrinkwrap` so you're pretty well covered.

Reply on news.ycombinator.com