Posts

Posted on

About NPM deprecation warnings

It baffles me how many deprecation warnings appear when installing some NPM package. Like if I was the only one in the world seeing them, and worrying about them.

% npm i -g truffle

Some people say: “if it’s important (e.g. a security problem), notify the package maintainers; if not, ignore the deprecation warning.“

NPM deprecation warnings are displayed without any classification with respect to the dependency where they originate.

  • If the code of the deprecated package was not used at all (fake dependency), then we could safely ignore the deprecation warning.
  • If the code of the deprecated package was only used in development (dev dependency), then we could almost safely ignore the deprecation warning.
  • If the code of the deprecated package was also used in production, then we couldn’t ignore the deprecation warning without a detailed analysis.

Sample analysis

Let’s look at the first warning above:

testrpc@0.0.1: testrpc has been renamed to ganache-cli, please use this package from now on.

The deprecation message is not alarming. What should I do? Let’s research a bit more.

Here is the path from testrpc back to truffle:

% npm –global –all ls testrpc@0.0.1

/Users/andrea/.nvm/versions/node/v16.13.0/lib
└─┬ truffle@5.4.18
  └─┬ @truffle/db@0.5.36
    └─┬ @truffle/resolver@7.0.34
      └─┬ @truffle/contract@4.3.39
        └─┬ @ensdomains/ensjs@2.0.1
          └─┬ @ensdomains/ens@0.4.3
            └── testrpc@0.0.1

And here is the package.json in truffle:

package.json

Looking into package.json, we see that @truffle/db is an optional dependency, i.e. a production dependency which could also be not automatically installed when installing truffle.

Looking into @truffle/db, we see that it allows to configure truffle for using it:

db: {
  enabled: true
}

Given that I went for the default installation (and I don’t have a replacement ready), this is a production dependency for me. What should I do? Let’s research a bit more.

Googling @ensdomains/ens we get to the project page on GitHub:

https://github.com/ensdomains/ens

So this project is pretty popular, used by 7.7k other projects. And yet it uses a deprecated package. It’s still unclear what should I do.

This project was included (in its parent, @ensdomains/ensjs) at version 0.4.3. Such a version is nowhere to be found in the repo: not a release, not a tag, not a branch.

Let’s assume it’s a close ancestor of the current code in the master branch, which is marked as 0.5.0 in package.json.

This is what we get after searching for testrpc in the repo:

We see that this is a code dependency whose code is never used but the package name is cited in a README file. That’s it. it’s a fake dependency.

Now, I needed (wasted) a solid hour to find that out. That’s unreasonable.

Could a tool automate all of the above? Not really, because I had to assume that the code of the lost version 0.4.3, in all places where testrpc would be used, is equivalent to the code of the master version (maybe 0.5.0).

Posterity

There is something else that troubles me. If I wanted to persist the result of my research there is little support in the Open Source world as a whole. (I could be wrong. Please, correct me if you know better.)

A possible, but cumbersome, and incomplete solution could be one based on the following tools:

  1. selective dependency resolutions, implemented in NPM by npm-force-resolutions
  2. a fork of @ensdomains/ens (the troublesome package), where I could fix its deprecated dependencies, like aercolino/ensdomains-ens#fix-deprecations
  3. force a resolution, like 
{
  "@ensdomains/ens@0.4.3": "aercolino/ensdomains-ens#fix-deprecations"
}

However, that is totally hypothetical, because:

  • the package whose installation complained about testrpc@0.0.1 is global, which means that I do not have any package.json file where I can add my resolutions
  • npm-force-resolutions is poorly documented
  • the Selective dependency resolutions feature of Yarn, upon which npm-force-resolutions is based, doesn’t seem to support versions on the left, nor full repos on the right.

In the end, my research is going to get lost (in my biological memory) and my confidence in NPM lowers.

Posted on

Looking for the perfect match

Lately, I passed through many selection processes, and I still will go through some more. Did I meet a company where I really wanted to work at? Surely, for many I could have made a positive impact working there. But none was a perfect match. 1I’m not talking about cultural fit here

Why do we look for the perfect match? We should already know that such a thing doesn’t even exist. Lasting couples aren’t a perfect match. How can colleagues be a perfect match to each other? For n colleagues, that would require n * (n - 1) / 2 perfect matches. Insane.

I don’t look for the perfect match with my colleagues, but I must confess that I’m often relieved to get rejected by colleagues which present to me in the testudo formation.

Almost impossible to be admitted here, by design.

How do you expect to find a new team mate if, as soon as a discussion arises, you close ranks and state you know better. Nonetheless, they keep looking for the perfect match, which boils down to a developer with the biggest experience to write quality code without spoon-feeding her, and the smallest experience to follow orders with humbleness.

That, or likemindedness. Isn’t it a known problem to hire like minded people?

Such practices can 2I stroke this through also lead to groupthink where all go along with decisions for the sake of team harmony. Creativity, innovation and growth can 3I stroke this through suffer in the absence of diversity, vigorous debate and conflict.

I never liked to sheepishly follow others. Decades ago, when I was 10 years old, our school teacher gave us a mathematical problem to solve cooperatively. I immediately found a short solution, and shared it with the others. They dismissed it and decided to elaborate one of their own. How proud I was when our teacher validated my answer and not theirs.

During my job interviews, I genuinely make an effort to understand and value the programming decisions, mostly the architectural ones, that my yet-to-be colleagues made in the projects I’m asked to collaborate in. How could I not show my surprise when they tell me:

  • We can’t use Docker / Kubernetes because our setup is too complex
    • What? They are used at Google, I don’t think they have a simpler setup.
  • We prefer vanilla JavaScript to React, because it wouldn’t scale for us.
    • What? It’s used at Facebook, I don’t think they have a smaller scale.

Posted on

About TypeScript

I didn’t touch TypeScript once in the last 3 years. I stopped using it when I changed my job, from Angular 4 back to jQuery, AngularJS, and forth to VueJS.

  • Did I miss it? Not once.
  • Did I like it when I had to use it? I did.

But now my opinion on TypeScript is that it works like a self fulfilling prophecy. You think you need some control on the types of values you pass around in your application, and, in fact, as soon as you write a line of TypeScript, the linter first, and the compiler later, will immediately spot so many type errors. If you think about how many lines you wrote in JavaScript in the past, without any sort of type checking, they must have been all wrong!

Well, not really. The simplicity and strength of JavaScript is it lacks type checking. I wrote millions of lines of JavaScript, and not many of them with errors. I already know how to protect me from most of them. While developing, the JavaScript linter and the JavaScript test runner will immediately spot whatever I mistook. But also TypeScript needs a linter and a test runner, so that they do not represent a price for the lack of type checking.

While running… well, while running TypeScript is JavaScript and loses any notion of type. Surprising, but true. TypeScript only checks types at compilation time. You should validate whatever data enter into and exit from your code. For example, using Ajv to validate the JSON schemas of the responses you get for requests issued to API endpoints. Again, you need data validation in any case, so it’s not a price for the lack of type checking.

In the end, it seems to me that the benefits of TypeScript are less relevant than the drawbacks. Which is essentially one: development slowness, for having to get types right, when wrong types are hardly so subtle errors that you wouldn’t detect otherwise.