[yawaramin]

No, every interactive event doesn't need to have a network request in the loop. And you only need a tiny bit of client-side JS for a most of the plumbing.

It is quite pleasant to work with, because you don't have to worry about a constant stream of vulnerabilities or supply chain attacks. You just vendornthe script in your repo, add it as a <script> tag on the page, and you're done.

[Rohansi]

Supply chain attacks are not a JavaScript or npm exclusive risk. If you pull in any dependencies you have a supply chain risk.

[barrkel]

As is well known, security is not a binary, it's a spectrum. It's why you add security in layers, and why it's generally a trade-off between risk and usability.

Your mileage may vary, but I sleep better with my own projects not having any node_modules in their build tree.

[robertoandred]

How is htmx invulnerable to vulnerabilities and attacks?

[stymaar]

It's not invulnerable, I think gp just means that reducing your amount of dependencies reduces the attack surface.

[deadbabe]

Who is worrying? If JavaScript is on the front end the supply chain attacks are really not your problem.

[cpburns2009]

The supply chain attacks you need to worry about come from using npm.

[Rohansi]

No, it's not specifically npm. All package managers enable remote code execution by design - you tell it to download code and then you run that code, likely without sandboxing, by using it. Most people are not inspecting the code before they download and run it. You will still see compromised packages making their way through npm even though they disabled install scripts.

[cpburns2009]

I agree. I just pointed out npm because it's the most prominent javascript one.

[traverseda]

What? It handles your password fields.

[deadbabe]

Just do SSO.

[yawaramin]

Just do passkeys.