A lot indeed: https://www.bleepingcomputer.com/news/security/backdoor-in-p...

Exactly. Even if it had 10m loc and 10k dependencies, that’s not a problem at first sight.

In fact, the 1.5k dependencies in this example is a drop in the bucket when you consider all the dependencies that your react app needs to do anything useful (http, dns, tcp, ip, browsers, OS’s, et cetera).

I’m not defending React here, I don’t know enough about it, I’m just saying 1.5k dependencies for a hello world app might be bad, but it depends on the details.

And repeating as usual, it is caused by lack of standard library for js environment. All of things mentioned could've been packaged into 1-2 dependencies. But instead we need to independently add each one.

Similar case with babel and webpack, that each plugins (and loader) is a separate dependency. I don't know if it's more efficient or modular for development, but it is surely bloat the packages.

Agreed. Why reinvent a wheel that's there for the using, when you could be working on the aspects of your project that make it your project?

Because the scope of a project should include usability, speed, resource thrift, maintainability, and security.

The whole brogrammer culture of "throw another library onto the fire" is the reason that simple programs require crazy amounts of computing power.

Unless you are doing assembly language programming at a clean screen then you are building software that sits on the shoulders of other software.

It's not just JavaScript that has dependencies - everything does.

You make a very valid point, but compared to other programming languages and cultures, the JavaScript ecosystem encourages mammoth projects with many more dependencies than they need.

It’s not the concept of dependencies that’s at fault, it’s the number of them proportional to the task.

> Unless you are doing assembly language programming at a clean screen then you are building software that sits on the shoulders of other software.

Yet, we don't just eat dirt off the street because even when we eat the usual food, there's always some dirt in it.

Really bad analogy. Most runtime libraries (or OS libraries for that matter) of other programming languages are of high quality and don't introduce 20 seconds of non-interactivity on a gigabit connection and 4-core CPU with 32GB RAM.

A ton of websites out there do the latter.

I don't need to do assembly language programming because the tools I have (that are built on top of it) are actually good. Unlike those in JS land.