Ask HN: Why are JavaScript dependencies so messy?
Going to try and give a reasonably systematic answer to this:<p>Firstly: the title of the post is different to the content. The title asks why dependencies are a mess, the content cites problems with bundlers. These are entirely distinct topics. Bundlers don&#x27;t handle dependencies and package managers (mostly) don&#x27;t concern themselves with bundling. They&#x27;re different problems and have surprisingly little in common.<p>So the above breaks it down to two questions:<p>1. Content: Is javascript bundling a mess?<p>2. Title: Are javascript dependencies a mess?<p>To answer question (1) let&#x27;s first look at it comparatively. Are other language bundlers a mess? Obviously they don&#x27;t have any as bundling is a client-side problem and javascript is the only client-side target. So it&#x27;s hard to gauge this. Maybe bundling is a fundamentally hard problem that will always necessarily be a mess.<p>Subjective opinion: I think there are obvious ways bundling could be done better and it surprises me they haven&#x27;t been done but speaking from a place of inaction I&#x27;m reluctant to be too critical here.<p>To answer question (2) let&#x27;s look at it comparatively again:  are  javascript&#x27;s package management and library ecosystem more or less of a mess than Java&#x27;s, Python&#x27;s, PHP&#x27;s, Golang&#x27;s, Rust&#x27;s, etc.? Some may disagree here but I think the answer is objectively &quot;no&quot;:<p>- The Ant&#x2F;Maven&#x2F;Gradle&#x2F;Bazek&#x2F;sbt ecosystem is absurd complexity, and I&#x27;ve seen plenty Java .m2 dirctories worse than node_modules. I think Java must only escape the criticism JS gets here because every Java dev I&#x27;ve met is so reliant on their IDE they don&#x27;t even know .m2 exists (same goes for ObjectiveC&#x2F;Swift)<p>- Python is both better and worse than Java. On one hand, the manager ecosystem is even more unapproachable: the setuptools easy_install pip pipx conda poetry venv pyenv nightmare isn&#x27;t even helped by consistently demarcated config files in your repo root: good luck figuring out what to run depending on whether there&#x27;s setup.cfg setup.py requirements.txt pyproject.toml etc. (if they even exist at all - pip not requiring project root dep config is why so many Python readmes just have long handwritten accounts of which deps you need to install manually). On the other hand, python&#x27;s actual dependency <i>tree</i> handling errs on the oversimplified side. Have two transitive dependencies on separate incompatible versions of a single library? Tough shit, rewrite your code.<p>Go seems to be leaning too heavily on Git and falling into the trap of modelling their package management system on the implementation rather than modelling the implementation on user needs. It&#x27;s not terrible though, but that&#x27;s perhaps due to its age.<p>PHP is probably the least messy, and Rust - while making some mistakes - is new enough to be following some good modern examples. But overall NPM is by far one of the LEAST messy package management ecosystems.