22 ms·
When it comes to understanding the risks involved with having this many dependencies, one thing that folks might not understand is that Rust's support for depen
by stuhood 2y ago
When it comes to understanding the risks involved with having this many dependencies, one thing that folks might not understand is that Rust's support for dependency resolution and lock files is fantastic.
Tools like `cargo audit` can tell you statically based on the lockfile which dependencies have security vulnerabilities reported against them (but you have to run it!). And Github's https://github.com/dependabot/ https://github.com/dependabot/ will do that same thing automatically, just based on the existence of the lockfile in your repo (and will also open PRs to bump deps for you).
And as mentioned elsewhere: Cargo's dependency resolver supports providing multiple versions of a dep in different dependency subgraphs, which all but eliminates the "dependency hell" that folks expect from ecosystems like Python or the JVM. Two copies of a dep at different versions? Totally fine.
- Threadbare 2y agoDoesn't node npm also do similar?
- stuhood 2y agoYes. AFAIK, it evolved over time across 3+ package managers (`npm`, `yarn`, `pnpm`, etc), but the current state of that ecosystem is similar (including the behavior of dependabot).
- robertlagrant 2y agoPython's Poetry has poetry audit as well, and there are third-party tools such as Safety (Python), Nancy (Golang), etc. Lots of languages have something like this.
- stuhood 2y agoThey support lockfiles and tools like `audit`, yes. But they do not support having multiple versions of a dependency. Tools based on loading libraries from a *PATH (Go, Python, JVM) usually do so by grabbing the first one that they encounter that contains the appropriate symbols. That is incompatible with having multiple versions of a package. On the other hand, Rust and node.js support this -- each in their own way. In Rust, artifact names are transparently suffixed with a hash to prevent collisions. And in node.js, almost all symbol lookups are accomplished with relative filesystem paths.
- robertlagrant 2y agoTrue!
- hulitu 2y ago> Tools like `cargo audit` can tell you statically based on the lockfile which dependencies have security vulnerabilities reported against them known security vulnerabilities. If someone compromises your cargo repository (see npm for examples) all your safety is gone.