You Don't Know Your Dependencies
summary
Claims that lockfiles make installs reproducible and that tooling can automate upgrades are backed by numbers and experiments: average dependency tree in top modules is about 295 dependencies (production-only ~30), while real-world apps jump to ~1,052 (production ~426). Demonstrations compare Greenkeeper and renovate, show using npm ci and cache strategies speeds installs, note local file: dependencies exist, and report a custom verifier that finds mismatched hashes and NPM releases missing corresponding GitHub tags.
AI-written summary · about
chapters (5)
- 0:00Start
- 2:01Pinning deps: yay or nay
- 8:05I've pushed a lockfile...now what?
- 9:20RENOVATE
- 15:12should you worry about your dependency tree size?
related talks
16mDependency Hell Just Froze Over
45mNext Gen Package Management
24mManaging Dependencies with Confidence
22mIt depends: A dialog about dependencies
25mThe node_modules Iceberg: Mysteries Below the Waterline
38mDependency Management: The Cause of—and Solution to—All Supply...
27mDependency hell - Or, Developers' perception of software dependencies
39mTrials and Tribulations of Updating Dependencies for Vulnerability...