<div dir="ltr"><div dir="ltr">On Thu, 24 Oct 2019 at 19:45, Stefan Herbrechtsmeier <<a href="mailto:stefan@herbrechtsmeier.net">stefan@herbrechtsmeier.net</a>> wrote:<br></div><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">> The package-lock.json in their tarball is 600K.<br>
<br>
The project use two major version and seven different versions with 30 <br>
installations of debug. Furthermore the dependencies include build tools <br>
which should not be installed on the device.<br>
<br>
The "@angular/cli" (242) and "node-red" (324) package share 106 packages.<br></blockquote><div><br></div><div>I have to ask: what point are you trying to make?<br></div><div><br></div><div>Here's a related lwn article describing a similar problem faced by opensuse:</div><div><a href="https://lwn.net/Articles/712318/">https://lwn.net/Articles/712318/</a></div><div><br></div><div>""Ruby dependency hell has nothing on JavaScript dependency
hell," he said. A "hello world" application based on one JavaScript
framework has 759 JavaScript dependencies; this framework is described as
"a lightweight alternative to Angular2". There is no way he is going to
package all 759 dependencies for this thing; the current distribution
package-management approach just isn't going to work here."</div><div><br></div><div>Alex<br></div></div></div>