TIL: Transitive Deps

I'm fascinated by dependency resolution in npm, probably a result of all the emotional damage it's caused me over the years.

A transitive dependency npm refers to a package that your project relies on indirectly, through another package you’ve explicitly installed.

Why they caught my eye

Isolated installs, highlighted in bun 1.3's release notes. I noticed some of my builds were failing after I updated my bun binary. Bun stopped supporting transitive dependencies by default, and what that meant is that in my monorepo, some apps and internal packages were making use of npm packages that were installed elsewhere, and happened to be in node_modules as a result, hence working locally.

This forced me to explicitly define npm packages that I was using in each app. The big pro for me is this:

ensures reproducible, deterministic builds.

Addressing security concerns

• Securing Transitive Dependencies in End-of-Life Software: A Guide by Edward Ezekiel
• Understanding Transitive Dependencies in npm: Simplifying Your Node.js Project by Evan Brooks for ONES.com Blog
• Risks of Transitive Dependencies in Node.js by Sergey Egorenkov