[mattlondon]

> Micro-libraries are really good actually, they're highly modular, self-contained code

Well I think that is the point, they're not self-contained. You are adding mystery stuff and who knows how deep the chain of dependencies go. See the left-pad fiasco that broke so much stuff, because the chain of transitive dependencies ran deep and wide.

NPM is a dumpster fire in this regard. I try to avoid it - is there a flag you can set to say "no downstream dependencies" or something when you add a dependency? At least that way you can be sure things really are self-contained.

[a_wild_dandan]

There is a "no downstream dependencies" option; it's called writing/auditing everything yourself. Everything else -- be it libraries, monolithic SaaS platforms, a coworker's PR, etc. -- is a trade off between your time and your trust. Past that, we're all just playing musical chairs with where to place that trust. There's no right answer.

[funcDropShadow]

The article doesn't claim to have an answer for everything. The article argues that tiny i.e. micro libraries are a almost always a bad tradeoff.

[ristos]

Yeah there's a way to do that, yarn and pnpm can flatten the dependency tree. You can add the fork directly too:

yarn add <path/to/your/forked/micro-library.git>

pnpm add <path/to/your/forked/micro-library.git>

[IgorPartola]

I remember adding a random date picker that pulled in a copy of React with it to a non-React project. NPM is a dumpster fire at a nuclear facility.