Hacker News Reader

Comment by ecnahc515 | Hacker News Reader

With some other languages, you have big projects that basically are your secondary stdlib. Boost in C++, Apache Commons in Java, etc. These can reduce a lot of your dependencies down to a single umbrella project who stewards everything. The number of developers who work as maintainers on the packages within these projects is probably comparable to the number of developers working on the same sorts of packages in Node, but they're all working under a single banner, effectively. It's about having dependencies within projects as organizations vs the NPM approach where basically every dependency is it's own project and organization.

View on HN

They don't even need to be big. They just need to cover a subject, but most of it needs to be the library code instead of a thin wrapper around multiple libraries. Take Carbon, the PHP library. It is centered around date time manipulation and provides a cleaner alternative to the standard library. It only has 6 dependencies, and I figure it wouldn't take long to vet it. The Laravel Framework also has few dependencies, and it was a delight to browse.

I created a small Node+Express project, added a few dependencies to handle things like CORS, API Authentication, ORM, and data validation, and my node_modules folder has 300 packages already. Frontend wise, it's worse.

I only used a few libraries when I was doing Android, most of them utilities and vendor SDKs. And the contrast is even higher in another project I'm working on. The Java Code takes less than 10 minutes to build, while the frontend code turns the laptop into a jet.

> I created a small Node+Express project, added a few dependencies to handle things like CORS, API Authentication, ORM, and data validation, and my node_modules folder has 300 packages already. Frontend wise, it's worse.

The vast majority of node dependencies are for testing frameworks and other tools that are never shipped to the customer.

For example, if you install any tool that does pretty command line output, odds are it installs some console UI libraries as a dependency, and odds are they also install a lower level curses like library as a dependency.

(Also I've yet to meet a simple ORM system!)

Jest is another common offender, much like every other popular testing framework, it is large and complex, and due to the nature of Javascript, it is also more powerful than a lot of the other testing frameworks I have seen (e.g. Jest can do stuff at runtime that Java frameworks need to do at compile time).

Those Java frameworks that go in and mock classes are complicated, but they are all hidden behind a "single" dependency.

Regarding front end build times, if a frontend website is taking any amount of time to build, something else is wrong (e.g. TypeScript is rebuilding everything one very build). Typical frontend website dev stacks have hot reloading enabled that allows for the site to be refreshed and updated the instant a file is saved. Nicer setups live change the DOM and try to avoid reloading the page unless something touching state management has been altered.

(My experience is with React and Svelte alongside TS, Angular may be a different story, not sure!)

> Those Java frameworks that go in and mock classes are complicated, but they are all hidden behind a "single" dependency.

I'd take complicated and sane over the literal software illusions that many npm packages are.

> Regarding front end build times, if a frontend website is taking any amount of time to build, something else is wrong;

Not necessarily. Any production build should start from scratch (the dependencies may be cached).

> due to the nature of Javascript, it is also more powerful than a lot of the other testing frameworks I have seen (e.g. Jest can do stuff at runtime that Java frameworks need to do at compile time)

oof... way to snatch defeat from the jaws of victory :(.

Jest is magic, but far less magic than rewriting JVM bytecode.

I generally prefer less magic over more magic.

> The vast majority of node dependencies are for testing frameworks and other tools that are never shipped to the customer.

So just to test I installed Django in a new virtualenv. I get a testing framework, and ORM, CORS, authentication, data validation, hot reloading and much more. It's three dependencies: django, asgiref and sqlparse.

Part of it is that Django just builds a ton of stuff on their own, but they also have the Python stdlib to build on.

As others mentioned you have things like Boost, the Go standard library, or even libc (of which there are multiple implementations). There's no reason why you couldn't have a JavaScript standard library, or multiple. They don't have to be shipped with the browsers, in fact I think that would be a bad idea. So when you start a new JavaScript project, you pull in your favorite standard library and when you ship your code, the bundler or whatever it's called could analyze your code pull out the relevant bits of the standard library and only include the bits you need.

> As others mentioned you have things like Boost, the Go standard library, or even libc (of which there are multiple implementations). There's no reason why you couldn't have a JavaScript standard library, or multiple. They don't have to be shipped with the browsers, in fact I think that would be a bad idea. So when you start a new JavaScript project, you pull in your favorite standard library and when you ship your code, the bundler or whatever it's called could analyze your code pull out the relevant bits of the standard library and only include the bits you need.

That is kinda-sorta how things work, except JS devs like to split code up into smaller modules.

https://www.npmjs.com/package/jest?activeTab=dependencies has 4 dependencies, if you look at @jest/core a lot of its dependencies are in fact other parts of the same project.

The lack of batteries included means there is a lot more room for diversity, if someone wants to write a new server to compete with express (and plenty of people have) they can follow the same middleware API standard and you can swap our your existing web server for another one but your ORM will still work!

Also a minimum viable JS Rest endpoint is literally 4 or 5 lines of code. Getting cors working is 2 or 3 lines more (based on if you count the import statement as a LoC).

Adding schema validation to an endpoint is another 2 LoC.

The number of concepts needed to be understood to setup an endpoint in Node land is minimal, and you can then build out whatever tools you want on top.

If you want a batteries included framework, there are also plenty of those, from fullstack systems Sveltekit and Next.js to multiple starter templates for backend services that give you whatever tools you wanted.

People go "Python has Django" and there are huge advantages to having a single golden path, but Node has a richness in the ecosystem that lets people start off small with and choose what tooling is best as their projects grow.

And at the end of the day, an ORM is going to require N lines of code, it doesn't matter if it is bundled with a framework of it is an external dependency.

The JS ecosystem has moved away from massive monolithic packages due to bundle size constraints. Unfortunately, JS code has a lot of extra constraints placed on it since it has to be instantly performant over the wire. Something desktop apps don't have to deal with!

jQuery and Lodash could be considered "secondary stdlib" packages. Lodash for various data functions, and jQuery for dom manipulation functions. Now that other frameworks are more common and the basic stdlib is larger, many projects have migrated away from them to improve bundle size. (As an example, pulling in one lodash function tends to pull in lots of other functions from within lodash, unnecessarily inflating the amount of code sent to the browser.)

Another advantage of this, at last for the backend, is that Node itself has a small footprint. Compared to the JVM, Node is tiny. It does some IO stuff and some eventing stuff and not much else.

For the front end, ideally tree shaking is used, and even fancier build systems create code that doesn't pull down dependencies until they are actually needed at runtime.

Why not just strip out unused code? This has existed in other toolchains for years.

Tree shaking exists in build tools, but (1) libraries like Lodash have functions that use many other functions in the same library (for DRY reasons) and (2) the issue with NPM libraries is that they generally pull in all dependencies and Dev dependencies, not just an efficient dist / build minimal code set.

Fwiw I strip out my dev deps before publishing. I've started bundling in the prod deps and stripping them too. That way if I need like 5 random functions from 5 random packages the end result just includes the 5 funcs and has 0 deps. It avoids version issues too. And I don't minify anymore so it's very readable.

...or you can have a solid stdlib like Go where you don't need any dependencies to do everything from encryption to regex to json encoding, image creation and MIME parsing.

I wish more languages would invest in their stdlib.

JS is burdened by being a browser standard though. But this could be worked on I agree. But then who leads that?

With Go there is an owner at least.

I am pretty sure that Javascript programmers would love to have a better stdlib.

But who is going to do it?

That might be bit better from a security perspective but modularity and code reuse are good things and npm makes them easy

I guess it’s a tradeoff

Reply on news.ycombinator.com