Why we added package.json support to Deno

[wrongcarwhy]

Reading the reasons...I could have told you this when Deno was released. Oh wait, pinned package versions are too specific??? Maybe you want some sort of tool where you can give it constraints on package versions and it'll find the minimal set that fits these constraints. Some sort of...package manager? And big url imports are kind of ugly no? If only there was a way to resolve them via a manifest that this package manager could also read. Some sort of package...file, like a package.json.

I dunno man, this feels like stuff the Deno people could have predicted. I don't understand why people treat packages like the boogeyman. You need a way to share and reuse libraries. Then you need a way to version these libraries. Then you need a way to reuse versions of said libraries. Then you need a manager to handle the reusing and constraint solving of libraries. It's a pretty logical sequence of events. I know it seems icky and gross and we should all just be real programmers and write our own dependencies, but you don't get paid to write dependencies.

I guess that's the issue. The people who write stuff like Deno or Node do indeed get paid to write dependencies. And it's too easy to listen to the people complaining about straw men like is-odd when in fact, for all the messiness, developers get a lot of utility out of packages.

[explaininjs]

> You don't get paid to write dependencies. I guess that's the issue. The people who write stuff like Deno or Node do indeed get paid to write dependencies.

Brilliant take. I realized something similar yesterday when my twitter feed was filled with people saying SSR/edge compute is the future... wait a second, you all work at Vercel, you make money by me computing stuff server side!

[HeavyFeather]

This whole ordeal completely smells like “15 competing standards”

[paxys]

Deno is the perfect real world example of a programmer looking at the complicated mess of code they wrote over many years, deciding to start fresh to fix all the problems, realizing their simple and elegant new product does not address all the use cases that the old one did, adding more and more complexity to it until it does, and eventually ending up with exactly what they had before.

[soderfoo]

When looking at my old code my internal dialogue flips between "What an idiot I was for writing this code" and "So brilliant and performant! I could never write code like this now."

[flohofwoe]

Hmm, I don't agree. I see Deno's package.json support as a pragmatic solution to interact with the rest of the world, but for my current use case (command line tools, switching over from Python) the npm registry is quite irrelevant, but the ability to directly import via URL is a real killer feature (also compared to Python).

(edited)

[rektide]

This feels really short & snide & simplistic to me.

I'd like to see you argue the other side of this discussion & see if you have the eye to appreciate what is better & nicer.

There's a lot of complexity that's still way way way away in the rear view mirror. It's still super possible & super nice to use deps.ts to tackle a lot of the current situations.

Very side mention on deps.ts, I think there is a bit of missing potential to pass your tree of deps into other packages deps, but this is definitely just working around import-maps's intended use case in userland.

[nonethewiser]

That is precisely the signal I received from this headline.

[MrOwnPut]

I mean... not really?

The goals of Deno and Node are different, the architecture is different.

Adding a compatibility layer helps Deno grow while maintaining its original goals.

I doubt this adds much complexity if done properly...

[tarruda]

Deno reminds me of how Python 3 decided to break compatibility in order to get rid of legacy code, and after finally replacing Python 2, has accumulated its own share of legacy.

[draw_down]

At least we get typescript, I guess.

[andrewstuart]

This is the right way to go.

Nodejs is “good enough”.

package.json is entrenched.

Deno gains nothing from not supporting package.json, and has everything to gain from becoming a “better node than node”.

Deno will pick up steam if it can become a drop in replacement for nodejs. Then people can start to exploit its unique features.

Ideally I could replace node and switch to deno by doing “npm install deno” from within an existing node project

[AbuAssar]

did you try bun? it is exactly what you just described

[joshmanders]

Got VC funding and now they realize their “we just want cool little scripts to do things” isn’t what the community wants, now Deno is gonna be Node but with TypeScript as a first class citizen and way less friendly.

[goodoldneon]

The anti package.json sentiment seems too puritanical. Sure there are downsides to it but I've rarely had a negative experience with it

[rektide]

Npm has had such a rocky marginal existence for so many years, getting bought out & passed around, getting random-ish backing & support to stay afloat. Now Microsoft owns Npm package repo & seems like a trustworthy-ish benevolent dictator & stable, but it's more than just ideologically gross to have all the tens of millions of eggs in one basket, it's a constraint on exploration & growth & trying other paths.

I think simply being free to try for better is a necessary & obvious step for js. It's not puritanical at all, it's embracing a lost freedom, to improve & figure stuff out.

[robertlagrant]

It is fairly bad. The scripts section, which can't call other scripts sections neatly, is the worst.

[rilut]

agreed, they got rid of package.json just for them to rediscover its convenience and reinvent it later

[HeavyFeather]

> I've rarely had a negative experience with it

We all bury bad memories. Feels like yesterday TypeScript couldn’t resolve a package because I set “moduleResolution: node16”

Oh wait, that’s still happening, because a dependency does not use the correct package.json exports setup.

[rektide]

Bare specifiers has been the tragedy of ESM. Nice module syntax... that is utterly u deoyable & which has had to have awful de-modularizing specifiers hard-coded into each file to make it work. Abominable sin to introduce "modules" to JS/es2015 then spend a decade dragging everyone along with no story for how to have modular modules.

Import-maps are like "here" to fix this on the web... finally... except they only are shipping to the happiest sunniest easiest case, with Web Workers being totally shit out of luck in spite of some very simple straightforward suggested paths forward. https://github.com/WICG/import-maps/issues/2

I think Deno is making pretty good tradeoffs along the way here. This looks like package.json at surface level, but there is a nightmare of complexity under the surface. Typescript, ESM, cjs all have various pressures they create & in Node it's just incredibly tight & tense dealing with packaging, where-as Deno's happy path of Typescript first does not slowly tatters one over time. It really has been super pleasant being free of the previous world, and having something much more web-platform centric, more intented, with less assembly & less building, and more doing the actual coding.

I confess I'm a bit surprised by this tack. The duplicate module issue felt somewhat solveable my offering more http urls... https://deno.land/[email protected]/uuid/mod.ts could be turned to https://deno.land/std@0/uuid/mod.ts to pick just the major version.

Also notably these un-pinned imports are going somewhat the opposite direction from hopefully upcoming work on subresource integrity in import-maps, where we we can really pin versions, https://github.com/WICG/import-maps/issues/221

I really hope import-maps eventually get broader support. Maybe this long-dwelling webworker issue should be brought up with WinterCG.

[mrozbarry]

One thing I'm curious about is if it's just possible to sort of roll your own package version manager as part of your deno app.

For instance, the current thing, from what I understand, is <code>import foo from 'https://some-cdn/your-library@^1.1.1'</code> and deno loads that in. The problem that adding a package.json solves (also, from my limited understanding) is for cases when you import this library in several places and have different version requirements.

So, why not have something like:

  export const libraries = {
    "some-library": "https://your-cdn/some-library@^1.1.1",
  };
  export const load = (library) => import(libraries[library]);

Wouldn't that mostly solve the problem without just doing what NodeJS does?

[illiarian]

Because now you have to write this manually for every package. And how do you deal with dependencies of that package that also need to be fetched from `your-cdn`?

Oh, perhaps write them in a JSON form in some sort of package.json and read them from there perhaps?

[timini]

The biggest issue with node.js was the terrible package manager. Looks like Deno is gonna make all the same mistakes.

[pictur]

Deno seems to have decided to try to solve problems by facing the past. This is really good.

[jonorsi]

My first draw to deno was to escape npm and the node_modules blackhole :(

[singularity2001]

almost! now separate the namespaces from the imports and we are good:

"imports": { "@namespace":"deno", "oak": "oak@12",

[est31]

But why json? json is only marginally human-editable as its pure version doesn't even support comments. toml is way nicer for this purpose I think.

[hombre_fatal]

I thought TOML was nice until I tried writing a parser that handled nested tables. There's very little convergence between libraries because it's such a hard / ambiguous problem.

I thought I was making good progress until I tried burntsushi's edge case test suite. It reminded me of implementing YAML.

TOML is slightly nicer to write than JSON if your structure is flat, like a php.ini or Cargo.toml file. Other than that, I prefer the simplicity of JSON as well as the buy-in of JSON Schema support in apps like VS Code.

We too often do this thing as craftspeople where we dramatize how much minor pain points impact our lives while ignoring the upsides.

[explaininjs]

For one, JSON has native support in the very language this runtime supports.