<story><title>NPM 6.9.1 is broken due to .git folder in published tarball</title><url>https://npm.community/t/npm-6-9-1-is-broken-due-to-git-folder-in-published-tarball/8454/2</url></story><parent_chain><item><author>kotxig</author><text>While this is clearly a bug, the default publish strategy is to publish all the contents of the package including dev&amp;#x2F;test files. If you look at the node_modules tree on a typical server-side node project it&amp;#x27;s full of garbage files.&lt;p&gt;We still think it&amp;#x27;s a great idea to pull down hundreds if not thousands of copies of modules from a remote every time we generate a build. The community has always been lacking maturity around how it manages modules and releases code for production, preferring to preserve developer productivity and trinket features over best security practices and optimizing for the size and quality of production packages.&lt;p&gt;I don&amp;#x27;t want to install hundreds of modules every time I create a new build. I don&amp;#x27;t want your tests or your README in my production tarball. I don&amp;#x27;t want your browser compatibility code in my server code. I don&amp;#x27;t want my node_modules tree to be 9 layers deep. I don&amp;#x27;t want to have to dedupe multiple copies of modules by hand. I don&amp;#x27;t want to have to debug where shrinkwrap isn&amp;#x27;t respected. I don&amp;#x27;t want to play roulette with the package manager version to figure out which one does the right thing for my package. I don&amp;#x27;t want to run your dubious pre&amp;#x2F;post install scripts. I don&amp;#x27;t want to use npm.&lt;p&gt;The sad thing is, npm is a commercial entity that has its package manager published by default with an opensource community project. And this is why we can&amp;#x27;t have nice things.</text></item></parent_chain><comment><author>shados</author><text>Thats why we never replaced our homegrown, predates-npm package manager. It feels crazy to be maintaining our own when there&amp;#x27;s such a popular 3rd party one out there, but honestly...it really sucks. Migrating nearly a decade worth of code to something that is often objectively worse doesn&amp;#x27;t feel worth it. And so the homegrown package manager lives on...</text></comment>
<story><title>NPM 6.9.1 is broken due to .git folder in published tarball</title><url>https://npm.community/t/npm-6-9-1-is-broken-due-to-git-folder-in-published-tarball/8454/2</url></story><parent_chain><item><author>kotxig</author><text>While this is clearly a bug, the default publish strategy is to publish all the contents of the package including dev&amp;#x2F;test files. If you look at the node_modules tree on a typical server-side node project it&amp;#x27;s full of garbage files.&lt;p&gt;We still think it&amp;#x27;s a great idea to pull down hundreds if not thousands of copies of modules from a remote every time we generate a build. The community has always been lacking maturity around how it manages modules and releases code for production, preferring to preserve developer productivity and trinket features over best security practices and optimizing for the size and quality of production packages.&lt;p&gt;I don&amp;#x27;t want to install hundreds of modules every time I create a new build. I don&amp;#x27;t want your tests or your README in my production tarball. I don&amp;#x27;t want your browser compatibility code in my server code. I don&amp;#x27;t want my node_modules tree to be 9 layers deep. I don&amp;#x27;t want to have to dedupe multiple copies of modules by hand. I don&amp;#x27;t want to have to debug where shrinkwrap isn&amp;#x27;t respected. I don&amp;#x27;t want to play roulette with the package manager version to figure out which one does the right thing for my package. I don&amp;#x27;t want to run your dubious pre&amp;#x2F;post install scripts. I don&amp;#x27;t want to use npm.&lt;p&gt;The sad thing is, npm is a commercial entity that has its package manager published by default with an opensource community project. And this is why we can&amp;#x27;t have nice things.</text></item></parent_chain><comment><author>LeoNatan25</author><text>Maybe &amp;quot;we&amp;quot; should not be writing our server code using a terrible ecosystem? Just an idea.</text></comment>