shrinkpack

I created https://github.com/JamieMason/shrinkpack in 2015 to try and help with this problem, by creating an offline mirror of decompressed tarballs from the npm registry that you'd check into your repository. I thought it might have some merit at the time, but it never really took off as an idea.

Using a lockfile and checking in your dependency tarballs [1] can help insulate you from these problems until you're ready to face them. I created shrinkpack before left-pad and thankfully it meant that we were unaffected. A lot of developers, understandably, baulk at checking in dependencies, but there is a concrete benefit in being able to continue uninterrupted during outages. [1] https://github.com/JamieMason/shrinkpack

Checking in your dependencies with https://github.com/JamieMason/shrinkpack can help insulate you from these problems until you're ready to face them. I created this before left-pad and thankfully meant that we were unaffected. A lot of developers, understandably, baulk at checking in dependencies, but there is a concrete benefit in being able to continue uninterrupted during outages.

I personally recommend caching package tarballs locally inside your project [0], using either Yarn's "offline-mirror" feature, or if you're using NPM, a tool called Shrinkpack [1]. Might not be the best fit for every project, it but it guarantees reproduceable installs without having to go out to NPM's servers. [0] http://blog.isquaredsoftware.com/2017/07/practical-redux-par... [1] https://github.com/JamieMason/shrinkpack

Shrinkpack[1] allows npm to provide completely deterministic builds. [1] https://github.com/JamieMason/shrinkpack

- PHP 5.6.x * Composer https://getcomposer.org/ * Zend :( * Codeception testing framework http://codeception.com/ - AngularJs 1.4.x * composer asset plugin (to avoid bower) https://github.com/fxpio/composer-asset-plugin * Shrinkpack https://github.com/JamieMason/shrinkpack (to avoid npm issues) * AngularUI https://github.com/angular-ui (Router, Bootstrap) * Bootstrap 2 & 3 * Ckeditor 4.4 * Lodash https://lodash.com * Moment.js http://momentjs.com/ * Numeral.js http://numeraljs.com/ - Swagger http://swagger.io/ - Git LFS https://github.com/github/git-lfs - Algolia - Gulp :( - Ruby 2.3 * Rake https://ruby.github.io/rake/ * Guard https://github.com/guard/guard * Data Anonymization https://sunitparekh.github.io/data-anonymization/ - MySQL 5.7 (AWS RDS) - Chef 11 - AWS Opsworks - AWS CloudWatch (Logs, Metrics and Alarms) - Ubuntu 14.04 Loo

Or just use shrinkpack: https://github.com/JamieMason/shrinkpack But that would be too easy...

I've been using the Shrinkpack tool ( https://github.com/JamieMason/shrinkpack ) to do that with NPM, and am trying to figure out how to do the same thing with Yarn (per my request at https://twitter.com/acemarke/status/785886788493553664 ). Definitely looking forward to that blog post from the Yarn team, but I'd definitely be interested in your own comments on how to use that "checked-in tarballs" approach.

Brilliant. I've been trying to tackle this problem for the last year or so with shrinkpack (https://github.com/JamieMason/shrinkpack) with _some_ degree of success and a nagging feeling that much more could be done. It's great to see attention is being spent on what is a really important area, one which has been largely under-appreciated in Node.js until now (aside from for a short period after the left-pad incident). Kudos to Facebook, I look forward to giving it a try.

I don't think the number of dependencies per individual project is a critical factor when setting up an internal npm mirror for all your projects (e.g. with Nexus [1] where I work) or vendoring dependencies per project (e.g. `npm shrinkwrap --dev && shrinkpack` [2]) - you're either doing it or you aren't. [1] http://books.sonatype.com/nexus-book/reference/npm.html [2] https://github.com/JamieMason/shrinkpack

Re-re-posting a comment I've made in a few threads now, because I feel this needs to get more awareness: I'm still learning and prototyping my first JS/NPM/React project, but https://github.com/JamieMason/shrinkpack seems to me like it solves _most_ of the issues involved here. It pulls down all the tarballs, and updates the npm-shrinkwrap.json to point to those instead. That way you check in a much smaller "node_shrinkwrap" folder of a few hundred tarballs and 15-20MB, rather than a node_modules folder of 30K files and 150MB and a bunch of platform-specific build outputs. Still doesn't solve the issue of installing new/updated dependencies that might actually require pulling in something that vanished, but at least once you've done an install and run "shrinkpack", you've got everything you need to rebuild right there.

Re-re-posting a comment I've made in a few threads now, because I feel this needs to get more awareness: I'm still learning and prototyping my first JS/NPM/React project, but https://github.com/JamieMason/shrinkpack seems to me like it solves _most_ of the issues involved here. It pulls down all the tarballs, and updates the npm-shrinkwrap.json to point to those instead. That way you check in a much smaller "node_shrinkwrap" folder of a few hundred tarballs and 15-20MB, rather than a node_modules folder of 30K files and 150MB and a bunch of platform-specific build outputs. Still doesn't solve the issue of installing new/updated dependencies that might actually require pulling in something that vanished, but at least once you've done an install and run "shrinkpack", you've got everything you need to rebuild right there.