Jonathan says “web people” like Obi-Wan says “sand people”

JB on WW3

I'm pretty sure "vendor" comes from the idea of buying a library from a separate software company that gets integrated into your codebase. It's a separation of first party code and code that comes from vendors. That idea got expanded to "any code we didn't write ourselves", including e.g. open source libraries.

“the software isn’t decaying” regarding local bundling of all dependencies is a big one for me.

No mention of the other recent big concern, supply chain attack?

Being in a country/area with slightly weaker telecomm infrastructure, the internet is cool and all, but I rarely have a stable and reliable connection unless it's LAN-only.
"Just log in, it all syncs online" is not a selling point if it does not work offline.

Already happens in Russia. There is now a great chance that some piece of code is not available if you are located in Russia.

Wow. Depending on an internet connection and that some vendor's server is running to compile your code, is a very-very stupid idea.

gotta love python virtual environments for managing dependencies

You talked like it might have problems in the future. but it had caused problems in the past and still are today. Things like supply chain attack, and dependency no long available.
If I found a js project and it's updated more than a year ago. I would fear that it might not work.
But when I found a c project updated 11 years ago, good chances are it still compiles and works.

in some platonic level games would run on my machine, but here in the cave i live  they break every time steam force me to do an update

Seems like the easy solution would be to just download dependencies. Managing after that point would be the same as other imports like the cpp stl, and we don't have a big huff over that being in everything.

The goal of any clownshow project is to get the node_modules folder so bloated that opening it is an existential crisis for your editor.

vcpkg in the root folder on my hard drive, every project just symlinks to that directory, not captured by git, every project has an init script (a batch\shell script that does the vcpkg package install), vcpkg backed up externally. (rclone to a networked store) - I have roached a vcpkg directory once before and it was about 24gb, ran all the scripts from each project as needed and it rebuilt itself again. - I move machines often, or I'm trying to do a quick recompile on a target, and the vcpkg setup lives in that init script, so I only need to download like 500mb of packages depending on the project, it's abstract enough to make the problem not visible to me.

Conan 2 is another tool I would like to investigate...

How I solve "dependency problem" is that:
1. There are language itself. It should have formal grammar and stable.
2. There are standard library. Something minimal that doesn't have any reason to change more often than language.
3. Rest of the dependencies I inject to my pure, dependency free code, so changing dependency doesn't affect to my code.

That's why C++ not having an official package manager/repository is the right design decision, no pulling in recursive dependency slop and it incentivizes library makers to keep their codebases standalone and low on dependencies

vendor is some rails nonsense

The most annoying thing is that only 10% of dependency code is used and other 90% just taking space. And if that dependency has its own dependencies - now you use 1% of that code.
There is 0 reasons for library to incorporate dependencies, librariy author should just copy code he needs.

Usually you define in the package.json if you want the package to be updated or if you just want patch updates. It is highly recommended to not enable automatic updates.
The lock file exists for the reason that the next person will get the exact build you have.  
I don't fully understand the problem