Hacker News new | ask | show | jobs
by nine_k 59 days ago
More seriously, keeping a local cache of external npm packages, and a local artifact storage for internal npm packages looks like a wise thing to have done long ago. Might be cheaper in the long run.

Ironically, both Nandu and Verdaccio are implemented in Tyepscript and install via npm.

(Same logic obviously applies to Python packages, Docker images, etc.)
4 comments
hmokiguess 59 days ago
At my former job we had a private registry that was a mirror of npm’s with an approval gate for packages devs would request and it would always pin versions

I took that for granted back then and just assumed it was standard enterprise policy

link
jamesfinlayson 59 days ago
Multiple previous jobs had this too (local Packagist is thing, Artifactory is another) but my current job got rid of theirs. Seemed a little short-sighted given the risks but I don't make the decisions.
link
spartanatreyu 59 days ago
> a local artifact storage for internal npm packages looks like a wise thing to have done long ago

Deno already does this invisibly by default.

All packages are stored in the global cache.

No need to store multiple versions of the same dependencies across projects.

To the code in your projects: there is no such thing as a global cache. Just import your dependencies like normal and deno maps them to the global cache.

link
XorNot 59 days ago
Caching NPM was easier when you could pull the Couchbase replicate API. Afaik that's gone and now you just have to send a bazillion http requests instead.
link
nine_k 59 days ago
Sending a bazillion http requests within your LAN, or at least your VPC, is much easier, faster, and cheaper.

Both yarn and pnpm support http/2 which speeds up the bazillion requests quite a bit.

link
miohtama 59 days ago
Only if we had a turn key distributed cache, like IPFS
link
ibejoeb 59 days ago
Does IPFS support content eviction now? If not, that could go wrong really fast. You get a compromised package out there and then, I think, literally every node needs to unpin it or it remains.
link
zadikian 59 days ago
Presumably, how ever you mark a version as latest would also be how you mark one as compromised. IPFS files are immutable and keyed by hash. But this seems like overengineering.
link
cluckindan 59 days ago
Waiting for the BitTorrent package manager
link