betterslides

Dependencies are

Hanley Leung · hanley.world
03:14, a tuesday

It wasn't our code.

$ kubectl logs api-7f9c --tail=6 Error: Cannot find module 'strip-ansi-cjs' at require (node:internal/modules/cjs/loader:1143) at Object.<anonymous> (/app/node_modules/…/index.js:3) WARN package unpublished from the registry 6h ago process exited with code 1
Four years of uptime, ended by a package nobody on the team had ever chosen.
the premise

Every dependency is a promise someone else has to keep.

You didn't borrow code. You borrowed a maintainer's attention — and it isn't in your budget.
what you actually shipped
1,247
transitive packages behind a 400-line service.
You read zero of them. So did your reviewer.
same job, ten years apart

One of these still runs in 2036.

inherited

node_modules/

  • ├── 1,247 packages, 41 direct
  • ├── 9 postinstall scripts you never read
  • ├── 3 packages with one maintainer
  • ├── 1 unpublished last night
  • ├── lockfile: 18,402 lines
  • └── audit: 14 vulnerabilities (4 high)
written
0 deps.
1 file.
400 lines you can read in an hour
tonight, five minutes

Pay one back.

$ npm ls --all | wc -l
1 run it on your smallest service
2 delete the one dep you could write in an hour
3 done = the diff is smaller than the lockfile
better-slides · by Hanley Leung · hanley.world
betterslides