npm allows us to specify
bundledDependencies, but what are the advantages of doing so? I guess if we want to make absolutely sure we get the right version even if the module we reference gets deleted, or perhaps there is a speed benefit with bundling?
Anyone know the advantages of
bundledDependencies over normal dependencies?
One of the biggest problems right now with Node is how fast it is changing. This means that production systems can be very fragile and an
npm update can easily break things.
Using bundledDependencies is a way to get round this issue by ensuring, as you correctly surmise, that you will always deliver the correct dependencies no matter what else may be changing.
You can also use this to bundle up your own, private bundles and deliver them with the install.
"bundledDependencies" are exactly what their name implies. Dependencies that should be inside your project. So the functionality is basically the same as normal dependencies. They will also be packed when running
Normal dependencies are usually installed from the npm registry. Thus bundled dependencies are useful when:
This way, you don't have to create (and maintain) your own npm repository, but get the same benefits that you get from npm packages.
When developing, I don't think that the main point is to prevent accidental updates though. We have better tools for that, namely code repositories (git, mercurial, svn...) or now lock files.
To pin your package versions, you can use:
Option1: Use the newer NPM version 5 that comes with node 8. It uses a
package-lock.json file (see the node blog and the node 8 release)
This is comparable to lockfiles in other package managers like Bundler or Cargo. It’s similar to npm’s npm-shrinkwrap.json, however it’s not lossy and it creates reproducible results.
npm actually copied that feature from
yarn, amongst other things.
npm shrinkwrapmost of the time, and sometimes put the whole thing, including the node_module folder, into your code repository. Or possibly use shrinkpack. The best practices at the time were discussed on the node.js blog and on the joyent developer websites.
This is a bit outside the scope of the question, but I'd like to mention the last kind of dependencies (that I know of) : peer dependencies. Also see this related SO question and possibly the the docs of
yarn on bundledDependencies.