Join devRant
Do all the things like
++ or -- rants, post your own rants, comment on others' rants and build your customized dev avatar
Sign Up
Pipeless API
From the creators of devRant, Pipeless lets you power real-time personalized recommendations and activity feeds using a simple API
Learn More
Search - "npm issues"
-
A repo on GitHub I'm maintaining has grown with 200k downloads / month since I started working on it a year ago. My recipe? I added an npm badge in the readme showing downloads / month and I responded to every issue and reviewed every PR. Now there's so much issues and PRs coming in that we had to add an extra maintainer, feels great! Teamwork, fuck yeah!
Not every PR got merged of course, but every single one of them got reviewed. Just being a good and friendly developer, giving back to the community that has given me so much. Some tips for you maintainers out there. If you have a popular project and no time there's always someone else who's willing to spend time on it, ask around and you will surely find someone else.6 -
Have you always been missing ads in CLI applications? Have you been wondering how to bring such modern browsing experience to CLI? NPM has solved this problem, it has CLI ads now!
https://github.com/standard/...
However, the are already people who spoil this great new experience with CLI ad blockers:
https://github.com/kethinov/...26 -
Be me, new dev on a team. Taking a look through source code to get up to speed.
Dev: **thinking to self** why is there no package lock.. let me bring this up to boss man
Dev: hey boss man, you’ve got no package lock, did we forget to commit it?
Manager: no I don’t like package locks.
Dev: ...why?
Manager: they fuck up computer. The project never ran with a package lock.
Dev: ..how will you make sure that every dev has the same packages while developing?
Manager: don’t worry, I’ve done this before, we haven’t had any issues.
**couple weeks goes by**
Dev: pushes code
Manager: hey your feature is not working on my machine
Dev: it’s working on mine, and the dev servers. Let’s take a look and see
**finds out he deletes his package lock every time he does npm install, so therefore he literally has the latest of like a 50 packages with no testing**
Dev: well you see you have some packages here that updates, and have broken some of the features.
Manager: >=|, fix it.
Dev: commit a working package lock so we’re all on the same.
Manager: just set the package version to whatever works.
Dev: okay
**more weeks go by**
Manager: why are we having so many issues between devs, why are things working on some computers and not others??? We can’t be having this it’s wasting time.
Dev: **takes a look at everyone’s packages** we all have different packages.
Manager: that’s it, no one can use Mac computers. You must use these windows computers, and you must install npm v6.0 and node v15.11. Everyone must have the same system and software install to guarantee we’re all on the same page
Dev: so can we also commit package lock so we’re all having the same packages as well?
Manager: No, package locks don’t work.
**few days go by**
Manager: GUYS WHY IS THE CODE DEPLOYING TO PRODUCTION NOT WORKING. IT WAS WORKING IN DEV
DEV: **looks at packages**, when the project was built on dev on 9/1 package x was on version 1.1, when it was approved and moved to prod on 9/3 package x was now on version 1.2 which was a change that broke our code.
Manager: CHANGE THE DEPLOYMENT SCRIPTS THEN. MAKE PROD RSYNC NODE_MODULES WITH DEV
Dev: okay
Manager: just trust me, I’ve been doing this for years
Who the fuck put this man in charge.11 -
Oh F***, not again!
Bob, every single time you "patch" the servers I run into issues, that you cannot fix.
Bob: "heuuu... I don't know anything about python or npm or any of that"
Then stop touching it!!!1 -
When you have dependency issues and can't work it out...
Just run
#npm install all-packages
And wait a millennia
https://npm.io/package/...6 -
> Be chad lodash dev
> new security vulnerability discovered in April
> low
> virgin devs ask to fix https://github.com/lodash/lodash/...
> giving no shit, because lodash stronk https://github.com/lodash/lodash/...
> fast forward now
> NPM lists lodash as vulnerability, because no fix
> 1000s of downstream projects affected
> https://github.com/lodash/lodash/...
> surprised pikachu face10 -
Running a fucking conda environment on windows (an update environment from the previous one that I normally use) gets to be a fucking pain in the fucking ass for no fucking reason.
First: Generate a new conda environment, for FUCKING SHITS AND GIGGLES, DO NOT SPECIFY THE PYTHON VERSION, just to see compatibility, this was an experiment, expected to fail.
Install tensorflow on said environment: It does not fucking work, not detecting cuda, the only requirement? To have the cuda dependencies installed, modified, and inside of the system path, check done, it works on 4 other fucking environments, so why not this one.
Still doesn't work, google around and found some thread on github (the errors) that has a way to fix it, do it that way, fucking magic, shit is fixed.
Very well, tensorflow is installed and detecting cuda, no biggie. HAD TO SWITCH TO PYHTHON 3,8 BECAUSE 3.9 WAS GIVING ISSUES FOR SOME UNKNOWN FUCKING REASON
Ok no problem, done.
Install jupyter lab, for which the first in all other 4 environments it works. Guess what a fuckload of errors upon executing the import of tensorflow. They go on a loop that does not fucking end.
The error: imPoRT eRrOr thE Dll waS noT loAdeD
Ok, fucking which one? who fucking knows.
I FUCKING HATE that the main language for this fucking bullshit is python. I guess the benefits of the repl, I do, but the python repl is fucking HORSESHIT compared to the one you get on: Lisp, Ruby and fucking even NODE in which error messages are still more fucking intelligent than those of fucking bullshit ass Python.
Personally? I am betting on Julia devising a smarter environment, it is a better language already, on a second note: If you are worried about A.I taking your job, don't, it requires a team of fucktards working around common basic system administration tasks to get this bullshit running in the first place.
My dream? Julia or Scala (fuck you) for a primary language in machine learning and AI, in which entire environments, with aaaaaaaaaall of the required dlls and dependencies can be downloaded and installed upon can just fucking run. A single directory structure in which shit just fucking works (reason why I like live environments like Smalltalk, but fuck you on that too) and just run your projects from there, without setting a bunch of bullshit from environment variables, cuda dlls installation phases and what not. Something that JUST FUCKING WORKS.
I.....fucking.....HATE the level of system administration required to run fucking anything nowadays, the reason why we had to create shit like devops jobs, for the sad fuckers that have to figure out environment configurations on a box just to run software.
Fuck me man development turned to shit, this is why go mod, node npm, php composer strict folder structure pipelines were created. Bitch all you want about npm, but if I can create a node_modules setting with all of the required dlls to run a project, even if this bitch weights 2.5GB for a project structure you bet your fucking ass that I would.
"YOU JUST DON'T KNOW WHAT YOU ARE DOING" YES I FUCKING DO and I will get this bullshit fixed, I will get it running just like I did the other 4 environments that I fucking use, for different versions of cuda and python and the dependency circle jerk BULLSHIT that I have to manage. But this "follow the guide and it will work, except when it does not and you are looking into obscure github errors" bullshit just takes away from valuable project time when you have a small dedicated group of developers and no sys admin or devops mastermind to resort to.
I have successfully deployed:
Java
Golang
Clojure
Python
Node
PHP
VB/C# .NET
C++
Rails
Django
Projects, and every single fucking time (save for .net, that shit just fucking works on a dedicated windows IIS server) the shit will not work with x..nT reasons. It fucking obliterates me how fucking annoying this bullshit is. And the reason why the ENTIRE FUCKING FIELD of computer science and software engineering is so fucking flawed.
But we can't all just run to simple windows bs in which we have documentation for everything. We have to spend countless hours on fucking Linux figuring shit out (fuck you also, I have been using Linux since I was 18, I am 30 now) for which graphical drivers for machine learning, cuda and whatTheFuckNot require all sorts of sys admin gymnasts to be used.
Y'all fucked up a long time ago. Smalltalk provided an all in one, easily rollable back to previous images, easily administered interfaces for this fileFuckery bullshit, and even though the JVM and the .NET environments did their best to hold shit down, and even though we had npm packages pulling the universe inside, or gomod compiling shit into one place NOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO we had to do whatever the fuck we wanted to feel l337 and wanted.
Fuck all of you, fuck this field, fuck setting boxes for ML/AI and fuck every single OS in existence2 -
Gotta love npm open source packages
A developer appears to have purposefully corrupted a pair of open-source libraries on GitHub and software registry npm — “faker.js” and “colors.js”
https://snyk.io/blog/...
https://theverge.com/platform/amp/...
https://github.com/Marak/colors.js/...16 -
So lets start here, as i have been preparing myself for a while for that rant. I have been putting it off for a while, but today I had enough.
Fuck react-native and fuck facebook react-native team. Bunch of lazy incompetent twats.
The all amazing framework that suppose to be speed up your development process, since you don't have to compile your code after each change. SO FUCKING WHAT if the god damned framework is so fucking buggy and so fucking shit that you constantly have to fix build, dependancies etc issues. Every day since I work on this project that is using react-native I have to deal with some of the react fucked up behaviour. You got an issue ? don't worry google it just to find out that 100 other people had the same issue. Scroll through down the bottom of the page just to find out that facebook devs have closed the issue as resolved (without fucking fixing it) because there wasnt recent replies to the post. Are you fucking kidding me? It's ok thou, create a new issue just to get an automatic reply from the bot that locks the thread and keeps it locked till you update your React-native version to the newest one. You do that and guess fucking what? Their newest version fucks up remote debugging on iOS(fucking android been broke for over a year) so say good bye to debugging your js code. Documentation is fucking trash. You found a nice function like autoCaptialise on your text input? Great! Ah wait, its not fucking working, what is wrong? You google this just to fucking found out it, function never worked on android, so why the fuck you still have it exposed and still have it in your docs? You want to add package? So fucking ez, just type npm install <name of the package>. Ha! fuck you, you still have to go and add them fucking manually in gradle in android and in pod in xcode, because obviously react-native is a one big fucking bullshit. Oh and a scroll view is a fucking glorious highlight of that framework, try add some styling to it, you gonna have loads of fun. Fuck react-native. And fuck the fucking idiot who convinced my boss that framework is so fucking great and now I have to work on this shit. Sincerely Xamarin Developer.9 -
Beware of NPM packages maintained by Brandon Nozaki Miller alias RIAEvangelist. He added IP-specific malware to node-ipc.
https://security.snyk.io/vuln/...
https://github.com/RIAEvangelist/...16 -
tl;dr - install ‘Pop!_os’ and try it out if you haven’t yet, it’s pretty damn good!
Heavy Micro$haft user here, have tried using ubuntu a bunch of times in the past and fucking regretted it every time. Ran into issues with stupid shit like the apt cache growing exponentially until the drive was full, or something like the the system python getting borked.
To be fair, I’m 120% certain my dumb-assery is what caused the problems. I’m definitely not trying to blame the OS. But my experience was shitty, even if it was at my own hands lol.
Started playing around with Pop!_os from the system76 team. And I’m seriously in freakin’ love with this OS. It’s clean, is performant, feels way less buggy or just feels more stable somehow. I know it’s based on ubuntu, but I’ve had a great time thus far using it. I’ve got ansible, docker, aws toolkit, aws cli, sam-cli, vscode, dynamodb-local, serverless, npm, brew, and working on steam now.
Everything has been a breeze and again the system feels really fast and snappy. It feels a lot like mac on the smoothness scale, but snappy like a windows box with beefy hardware specs.
I’m still just in the testing phase on a VM, but I’m seriously thinking about blowing away my windows install for Pop!_os.
(I’ll try arch someday when I’m up for some hardcore masochism)8 -
I wrote an auth today.
Without frameworks. Without dependencies. Without under-the-hood magic. Without abstract pluggable adaptor modules for the third-party auth library with 63 vulnerabilities and 1252 GitHub issues. Without security vulnerabilities showing up in NPM log. Without dependency of a dependency of a dependency using md5 and Math.random() under the hood for historical reasons, and now we're fucked, because this is the only lib for our framework, and we have no time to write our own replacement. Without all that shit.
Rock-solid, on top of scrypt. Stateless and efficient.
It felt amazing.9 -
Every fucking time I install a new npm package
npm WARN deprecated core-js@2.5.7: core-js@<3.0 is no longer maintained and not recommended for usage due to the number of issues. Please, upgrade your dependencies to the actual version of core-js@3.
npm WARN deprecated fsevents@1.2.9: One of your dependencies needs to upgrade to fsevents v2: 1) Proper nodejs v10+ support 2) No more fetching binaries from AWS, smaller package size
npm WARN deprecated gulp-util@3.0.8: gulp-util is deprecated - replace it, following the guidelines at https://medium.com/gulpjs/...
npm WARN deprecated browserslist@2.11.3: Browserslist 2 could fail on reading Browserslist >3.0 config used in other tools.
npm WARN deprecated domelementtype@1.3.0: update to domelementtype@1.3.1
npm WARN deprecated circular-json@0.3.3: CircularJSON is in maintenance only, flatted is its successor.
npm WARN deprecated flatten@1.0.2: I wrote this module a very long time ago; you should use something else.21 -
So, I've had a personal project going for a couple of years now. It's one of those "I think this could be the billion-dollar idea" things. But I suffer from the typical "it's not PERFECT, so let's start again!" mentality, and the "hmm, I'm not sure I like that technology choice, so let's start again!" mentality.
Or, at least, I DID until 3-4 months ago.
I made the decision that I was going to charge ahead with it even if I started having second thoughts along the way. But, at the same time, I made the decision that I was going to rely on as little external technology as possible. Simplicity was going to be the key guiding light and if I couldn't truly justify bringing a given technology into the mix, it'd stay out.
That means that when I built the front end, I would go with plain HTML/CSS/JS... you know, just like I did 20+ years ago... and when I built the back end, I'd minimize the libraries I used as much as possible (though I allowed myself a bit more flexibility on the back end because that seems to be where there's less issues generally). Similarly, any choice I made I wanted to have little to no additional tooling required.
So, given this is a webapp with a Node back-end, I had some decisions to make.
On the back end, I decided to go with Express. Previously, I had written all the server code myself from "first principles", so I effectively built my own version of Express in other words. And you know what? It worked fine! It wasn't particularly hard, the code wasn't especially bad, and it worked. So, I considered re-using that code from the previous iteration, but I ultimately decided that Express brings enough value - more specifically all the middleware available for it - to justify going with it. I also stuck with NeDB for my data storage needs since that was aces all along (though I did switch to nedb-promises instead of writing my own async/await wrapper around it as I had previously done).
What I DIDN'T do though is go with TypeScript. In previous versions, I had. And, hey, it worked fine. TS of course brings some value, but having to have a compile step in it goes against my "as little additional tooling as possible" mantra, and the value it brings I find to be dubious when there's just one developer. As it stands, my "tooling" amounts to a few very simple JS scripts run with NPM. It's very simple, and that was my big goal: simplicity.
On the front end, I of course had to choose a framework first. React is fine, Angular is horrid, Vue, Svelte, others are okay. But I didn't want to bother with any of that because I dislike the level of abstraction they bring. But I also didn't want to be building my own widget library. I've done that before and it takes a lot of time and effort to do it well. So, after looking at many different options, I settled on Webix. I'm a fan of that library because it has a JS-centric approach. There's no JSX-like intermediate format, no build step involved, it's just straight, simple JS, and it's powerful and looks pretty good. Perfect for my needs. For one specific capability I did allow myself to bring in AnimeJS and ThreeJS. That's it though, no other dependencies (well, at first, I was using Axios because it was comfortable, but I've since migrated to plain old fetch). And no Webpack, no bundling at all, in fact. I dynamically load resources, which effectively is code-splitting, and I have some NPM scripts to do minification for a production build, but otherwise the code that runs in the browser is what I actually wrote, unlike using a framework.
So, what's the point of this whole rant?
The point is that I've made more progress in these last few months than I did the previous several years, and the experience has been SO much better!
All the tools and dependencies we tend to use these days, by and large, I think get in the way. Oh, to be sure, they have their own benefits, I'm not denying that... but I'm not at all convinced those benefits outweighs the time lost configuring this tool or that, fixing breakages caused by dependency updates, dealing with obtuse errors spit out by code I didn't write, going from the code in the browser to the actual source code to get anywhere when debugging, parsing crappy documentation, and just generally having the project be so much more complex and difficult to reason about. It's cognitive overload.
I've been doing this professionaly for a LONG time, I've seen so many fads come and go. The one thing I think we've lost along the way is the idea that simplicity leads to the best outcomes, and simplicity doesn't automatically mean you write less code, doesn't mean you cede responsibility for various things to third parties. Those things aren't automatically bad, but they CAN be, and I think more than we realize. We get wrapped up in "what everyone else is doing", we don't stop to question the "best practices", we just blindly follow.
I'm done with that, and my project is better for it! -
Lol, people who use npm currently experience issues as npm install returns 418 I'm a teapot
Source: https://github.com/npm/npm/...1 -
Why does everything installed via npm sux so hard?
Why the fuck does any minor update in their bullshit packages either forces you to change config files:
E.g. now should be "@babel/core" instead of "babel-core" - WHAT A FUCKING SIGNIFICANT CHANGE!!! Rewrite all you configs motherfucker, that goddamn "@" in front of our shit is SO IMPORTANT that we will break everything to add it
Or breaks the code internally:
Consider the recent fail of fucking Terser [https://github.com/gatsbyjs/gatsby/...] that breaks fucking webpack and FORCE YOU TO ROLLBACK TO ANY VERSION THAT WORKS, why you nerd retards, can not run a simple dummy project BEFORE YOU RELEASE YOUR SHIT???!?!!?
Why any fucking update from *.*.1 to *.*.2 turns into hours of googling of what the fuck got broken this time??
The way that webpack, babel and other npm packages are released nowadays is absolutely retarded. I really have a strong feeling that it is better to keep old error-proof working config and NEVER UPDATE, than constantly suffer from butthurt
p.s.
Of course I am sorry for all the hate and caps in my post, and have respect for guys that develop amazing stuff for us for free, but I need to share this5 -
It looks like packages on npm have "disappeared".
https://github.com/npm/registry/...
Gotta love javascript.2 -
People wonder what would happen if internet went down while all it takes is npm repository and the dev world goes to shit xd
https://github.com/npm/cli/...2 -
me:task assigned is a small fix.Gonna finish Early sit back relax this sprint.
mail(next day):we've moved to microservices.setup as easy as gulp landscape:start
me:cool!shinny new stuff!seems easy!!
project:npm failed..please check module xxx..
me:fine.....
after long mail chain
project:npm failed unknown file not found
me:fine.....
after hours of googling and little github issue browsing
project:server running @ portxxx
me:yay finally happy life!!makes chnages, sent for review.
reviewer:code needs refactoring!!
me:make all changes..waits for faceless reviewer from another timezone!
reviewer:thumbs up.
me:i will make it in time!!!yes!!
jenkins:buid:failure
me:no still i wont give up...
debug finds out new bugs caused by unrelated code...make new PR the end is near,one day more will definitely merge!!!
mail:jenkins down for maintenance!
me:nooooo....waits till last minute gets thumbs up for merge, finally merged in the last second!!
all for 12 lines of code change.
:/
sad life -
- Need a module to work with PDFs
- npm install
- But wait, that requires some dependencies
- And those dependencies require more dependencies
- Python not found
- Issues with env variables and wsl
*Bajillion hours later*
- poppler-qt5 not found
What the hecc is a poppler and why do I need it?
:/11 -
Is VSCode some kind of sorcery?
I run into issues with node version compatibility with node-sass when tried "npm i" in the eOS console. Then I don't know why I tried the same command in the integrated terminal and had no problems.
What???2 -
Visual studio code has this feature where it will automatically add typescript import statements. It doesn't work properly for me on this angular project.
eg. I get this:
import { Output } from '@angular/core/src/metadata/directives';
instead of this:
import { Output } from '@angular/core';
After a few weeks of being annoyed at this I tried to search to see if there was a fix. Surely others must use vscode+angular? Anyway I found this issue and it is set to fixed in typescript 2.5:
https://github.com/Microsoft/...
So I check and I am using typescript 2.4. I read that angular has issues if you use an unsupported version of typescript but I cant find anywhere that actually says the versions that are supported. I try npm install typescript@latest anyway and sure enough angular-cli spits out some error. The error says to run npm install typescript@'>=2.1.0 <2.6.0'
That command doesnt work! maybe something about those quotes in windows command prompt but I manage to run it with double quotes npm install "typescript@>=2.1.0 <2.6.0" and now I have typescript 2.5.
I try out the auto import but it still doesn't work.1 -
Last week, I start creating a small npm package
And I literally don't know how to create it.
Please check it for the issues and let me know
https://npmjs.com/package/...4 -
Dependabot neither supports pnpm nor yarn:
https://github.com/dependabot/...
https://github.com/dependabot/...
The intention from GitHub is clear, Microsoft acquired npm and the fancy new supply-chain-security is just a lousy way of walling people inside the ecosystem.
GitHub is great, github.dev is amazing, VS Code is sick. But no, this one guy of Isaac Schlueter makes me hate this whole supply chain.
pnpm, renovatebot and GitLab: I choose you!4 -
The amount of time I spend fixing npm dependency issues is really tilting... How does the JS community consider this solving a problem! This reminds me of Java's package issues if anything...1
-
Maintained some old Dockerfile. Confused how `npm install` could possibly work as the working dir of that command was a *subfolder* with *no* `package.json`. Yet it verifyably installed into the correct package on build to the parent folder with the `package.json`. I assumed a grunt or npm script taking care of it, yet found nothing. Digging deeper, I realized: [this is by design](https://github.com/npm/npm/...).
-
Why is npm on windows so fucking horrible. Every fucking time I have to use npm on Windows I encounter a myriad of fucking issues. On MacOS it just seems to fucking work.
FUCK!13 -
I get so tired of people hating on PHP, Javascript and promoting Python or C#/Java.
Python is basically Perl with slightly different syntax plus has py2/py3 issues. And suffers from pip like js does from npm.
Java/C# started as application languages, while PHP started in web servers (again from Perl but at least it now has full object support). So comparing apples and oranges is one thing.
Another one is that people don't seem to know much about PHP / js (and tbh not even about the languages they are promoting) when they try to hate. That just comes off as lazy and borderline idiotic. Don't be that guy.
If you have had a bad experience, maybe you need to open the documentation instead of copying code from stack overflow.
Again, lazy and unprofessional.
Devs are supposed to be able to find the most efficient solution, that takes as little code as possible, not as little time from them when they arent familiar with the subject.
Damn Im angry right now, this rant really worked me up! :D6 -
From the look of https://github.com/yarnpkg/berry/..., Microsoft is not (yet) planning to hug "npm audit" as a great evil plan of asserting dominance to the open source community by raising everything into NatSec level and force shortcut releases.
If that's the case alternatives like yarn and pnpm will be removed from the scene, VS Code will be intentionally made incompatible with Yarn's PNP just like how NPM sneaks https://github.com/npm/arborist/... through, under the name of security.
I am still not convinced, it is Microsoft after all. We'll see.
P.S. I will laugh menacingly if that turns out to be ONLY a stupid dream and a poor decision of one single genius businessman.