Web dependencies are broken. Can we fix them? * Lea Verou

"Dear JS ecosystem, I love you, but you have a dependency management problem when it comes to the Web, and the time has come for an intervention. No, this is not another rant about npm's security issues. Abstraction is the cornerstone of modern software engineering. Reusing logic and building higher-level solutions from lower-level building blocks is what makes all the technological wonders around us possible. Imagine if every time anyone wrote a calculator they also had to reinvent floating-point arithmetic and string encoding!"

"In NodeJS, you just npm install and reference specifiers straight away in your code. Same in Python, with pip install. Same in Rust with cargo add. In healthy ecosystems you don't ponder how or whether to use dependencies. The ecosystem assumes dependencies are normal, cheap, and first-class. You just install them, use them, and move on. "Dependency-free" is not a badge of honor."

"There is nothing wrong with bundlers when used as a performance optimization to minimize waterfall effects and overhead from too many HTTP requests. You know, what a bundler is supposed to do. It is okay to require advanced tools for advanced needs, and performance optimization is generally an advanced use case. Same for most other things bundlers and build tools are used for, such as strong typing, linting, or transpiling."

JavaScript has a dependency management problem on the Web because the platform has outsourced dependency functionality to third-party tools. In healthy ecosystems dependencies are normal, inexpensive, and first-class, allowing developers to install and directly reference packages. The web platform instead offers fragmented primitives and no coherent end-to-end solution, pushing bundlers and build tools to fill the gap. Bundlers such as Webpack, rollup, esbuild, and browserify emerged to address this. Bundlers are appropriate for performance optimization and other advanced needs like strong typing, linting, and transpiling, but their widespread role signals a platform-level deficiency.

Read at Verou