Development Dependencies Considered Harmful
The author argues that development dependencies in software projects should be avoided or minimized because they introduce risks, maintenance burden, and security vulnerabilities. By keeping dependencies only for runtime needs and using tools to verify production code, developers can reduce complexity and improve project reliability.
Background
- The article is by Henri Bergius, creator of NoFlo and a longtime figure in the open-source JavaScript and flow-based programming communities.
- "Dependency hell" refers to the cascade of problems (security bugs, breakage, license conflicts) that occur when a project relies on dozens or hundreds of external packages.
- "Development dependencies" are packages needed only for building, testing, or developing software, not for running it in production. Tools like npm (Node.js) and pip (Python) distinguish these from runtime dependencies.
- Bergius argues that routinely separating dev deps is not enough: many dev-time tools (linters, bundlers, test frameworks) themselves pull in huge trees of packages, each of which can be exploited or abandoned, creating risk even before production.
- The piece echoes a broader 2020s reckoning in software engineering around supply-chain security (e.g. the left-pad incident, log4shell, and malicious npm packages).