Zen and the Art of Package Management
summary
Built three package managers — Bundler, Cargo, Yarn — and compares concrete behaviors: Cargo enforces semver (it refuses to publish "" ranges), NPM install is explicitly non‑deterministic, Yarn lacks conservative updates, and Servo’s encoding crate already shows ~30 reverse dependents. Presents cargo features* as a solved optional‑dependency pattern, argues for automatic local isolation, reproducible lockfiles, cached cross‑project builds, resolver backtracking (NP‑complete in practice) and the Highlander rule to avoid harmful duplicate public types.
AI-written summary · about
chapters (22)
- 0:00Start
- 0:05Zen and the Art of Package Management
- 3:48First, Some Terms
- 4:13Global Package Manager
- 14:11By breaking up your code, you massively increase the total number of people who can work on the entirety of your project's code
- 16:07A good local package manager...
- 19:27Developers still think in terms of the core workflows
- 22:09A stable ecosystem with rich dependency graphs
- 23:06isolates projects on the same machine from each other automatically
- 25:07One Option "Weak Linking"
- 30:31establishes conventions for units of code at the package level even when the underlying language only understands code at the module level
- 32:52reliably includes the same source code for each build across machines and environments
- 33:26Consider all potential dependencies from other profiles and platforms
- 34:30minimizes changes to unrelated packages when updating a single package
- 35:22caches as much work as possible between projects without sacrificing isolation
- 37:37supports temporary override of an application's dependencies for emergency fixes, upgrades or co-development
- 38:06escape valves are critical for maintaining faith in the overall system and especially its reliance on server compliance
- 39:18apps need to ship emergency fixes
- 39:42upgrades sometimes require tricky coordination across an entire dependency graph and use of not-yet-released code
- 40:21many developers co-develop secondary packages locally while working on dependent packages
- 40:37all of these scenarios call for an override feature that can apply to indirect dependencies
- 43:21attempts to unify dependency ranges into single packages when possible
related talks
10mStreamlining npm modules and lock files Management
39mBundlers: a deep dive into modern JavaScript build tools
51mYarn Berry: a next generation package manager
35mThe Social Coding Contract
41mThe Future of JavaScript Package Management
36mThe Role of Package Managers as Partners in License and Attribution Compliance
22mYarn — 2019 and Beyond
44mSwift Packages - Dependency Management of the Future