good luck to your friend with repeatable installations :P

news_hacker · on June 14, 2019

"If you wish to make apple pie from scratch, you must first create the universe"

- Carl Sagan

the npm ecosystem takes this quite literally, for better or worse.

stcredzero · on June 15, 2019

I'll credit npm with this, truly, when there's a package for each one of the Peano postulates. (As an actual functional dependency.)

JustSomeNobody · on June 14, 2019

If you need repeatable installations, wouldn't node be the wrong tool? I mean, you'd have to freeze everything yourself and then those libraries become _your_ problem. Ugh. That's a hell nobody wants.

chrisbroadfoot · on June 14, 2019

To be pedantic, it's "wouldn't npm be the wrong tool" (it isn't, necessarily, I believe lockfiles provide you with reproducible builds)

Vendoring/copying them is another way to achieve this (and means you don't need to depend on npm or its lockfiles).

Regardless, those libraries are your problem whether you vendor/copy them or not.

Read more: https://research.swtch.com/deps

quickthrower2 · on June 14, 2019

You’d just have a local cache, you can pull updates from authors if needed.