A deep dive into the three main causes of JavaScript dependency bloat in npm ecosystems: legacy runtime support (packages built for ES3/old Node versions that most developers don't need), atomic architecture (single-use micro-packages like 2-line regex checks downloaded hundreds of millions of times weekly), and outdated ponyfills that outlived their usefulness. The discussion covers real examples like `is-string`, `shebang-regex`, `path-key`, and `globalthis`, explains why these patterns emerged, and highlights the security risks of massive dependency trees. Solutions include the E18 Foundation's cleanup initiative, tools like `knip` for finding unused dependencies, the module-replacements project, and npm dependency graph visualization. The author donates $5,000 to the E18 Foundation and urges others to support the effort.
•33m watch time
3 Comments
Sort: