points by viklove 15 hours ago | 0 comments
Where do you find these guys? I haven't worked on a project with more than 20 dependencies, and usually those dependencies have 0 subdependencies so they're quite easy to audit.
[–] user43928 15 hours ago
[–] viklove 6 hours ago
Not sure how you operate, but I've never worked on any project in my 10+ years as a professionally employed JS dev where we've shipped Jest in our release.
I don't audit all the code I run (I don't think anyone does), but I do audit all the code I _release_. What's actually important to you?
[–] ang_cire 5 hours ago
You don't have to ship a dependency for it to be a vulnerability; the shai hulud worm was attacking dev machines and cicd environments to steal credentials. The deps you run are absolutely just as critical.
[–] xnorswap 15 hours ago
Are you including transient dependencies in that count?
[–] meindnoch 15 hours ago
*transitive
[–] viklove 15 hours ago
Yes 20 total dependencies including transients. If a lib has many subdependencies I take this as a red flag and try to avoid it.
[–] exe34 15 hours ago
No react then?
[–] viklove 6 hours ago
React has no dependencies:
https://www.npmjs.com/package/react?activeTab=dependencies
https://github.com/react/react/blob/main/package.json
If you read the first comment on your link, you'd see why you're wrong:
> That's not _React_, that's `create-react-app`
The Jest test runner alone has 250 dependencies in its latest version, and v25 had over 500.