Hacker News new | ask | show | jobs
by ashishb 161 days ago
> You’re looking at the number of dependents. The React package has no dependencies.

Indeed.

My apologies for misinterpreting the link that I posted.

Consider "devDependencies" here

https://github.com/facebook/react/blob/main/package.json

As far as I know, these 100+ dev dependencies are installed by default. Yes, you can probably avoid it, but it will likely break something during the build process, and most people just stick to the default anyway.

> Reproducible builds, or don’t use those packages.

A lot of things are not reproducible/hermetic builds. Even GitHub Actions is not reproducible https://nesbitt.io/2025/12/06/github-actions-package-manager...

Most frontend frameworks are not reproducible either.

> don’t use those packages.

And do what?
2 comments
nicoburns 161 days ago
> As far as I know, these 100+ dev dependencies are installed by default.

devDependencies should only be installed if you're developing the React library itself. They won't be installed if you just depend on React.

link
ashishb 161 days ago
> They won't be installed if you just depend on React.

Please correct me if I am wrong, here's my understanding.

"npm install installs both dependencies and dev-dependencies unless NODE_ENV is set to production."

link
sponnath 161 days ago
It does not recursively install dev-dependencies.
link
ashishb 161 days ago
> It does not recursively install dev-dependencies.

So, these ~100 [direct] dev dependencies are installed by anyone who does `npm install react`, right?

link
frio 161 days ago
No. They’re only installed if you git clone react and npm install inside your clone.

They are only installed for the topmost package (the one you are working on), npm does not recurse through all your dependencies and install their devDependencies.

link
SkiFire13 161 days ago
> ~100 [direct]

When you do `npm install react` the direct dependency is `react`. All of react's dependencies are indirect.

link
rafram 161 days ago
Run `npm install react` and see how many packages it says it added. (One.)
link
remexre 161 days ago
If you're trying to audit React, don't you either need to audit its build artifacts rather than its source, or audit those dev dependencies too?
link
timcobb 161 days ago
> And do what?

Keep on keepin on

link