6 ms·

I haven't used Deno, but I do use Bun purely as a replacement for npm. It does the hard-linking thing that seems to be increasingly common for package managers

I haven't used Deno, but I do use Bun purely as a replacement for npm. It does the hard-linking thing that seems to be increasingly common for package managers these days (i.e. it populates your local node_modules with a bunch of hard links to its systemwide cache), which makes it vastly quicker and more disk-efficient than npm for most usage. Even with a cold cache, `bun install` with a large-ish dependency graph is significantly faster than `npm install` in my experience. I don't know if Deno does that, but some googling for "deno install performance vs npm install" doesn't turn up much, so I suspect not? As a runtime, though, I have no opinion. I did test it against Node, but for my use case (build tooling for web projects) it didn't make a noticeable difference, so I decided to stick with Node.

homebrewer 10mo ago
pnpm does all that on top of node. Also disables postinstall scripts by default, making the recent security incidents we've seen a non-issue.
- antihero 10mo ago
  I’m not sure why but bun still feels snappier.
  - B56b 10mo ago
    This is why: https://bun.com/blog/behind-the-scenes-of-bun-install https://bun.com/blog/behind-the-scenes-of-bun-install
  - babyshake 10mo ago
    Aside from speed, what would the major selling points be on migrating from pnpm to bun?
- daheza 10mo ago
  Are there any popular packages that require postinstall scripts that this hurts?
- junon 10mo ago
  As the victim of the larger pre-Shai-Hulud attack, unfortunately the install script validation wouldn't have protected you. Also, if you already have an infected package on the whitelist, a new infection in the install script will still affect you.
- replete 10mo ago
  A whitelist in package.json is only a partial assist
satvikpendem 10mo ago
Deno does all that. Hell, yarn does too, or pnpm as the sibling mentioned.
- FINDarkside 10mo ago
  Sure, but pnpm is very slow compared to bun.
agumonkey 10mo ago
IIRC bun zig code base has a lot of fine optimization too. I think the lead did a conference explaining his work. Or maybe i'm confused.
- dolmen 10mo ago
  https://bun.com/blog/behind-the-scenes-of-bun-install https://bun.com/blog/behind-the-scenes-of-bun-install
  - agumonkey 10mo ago
    oh thanks yes, i couldn't find it, i was already lost thinking it was a conference by andrew kelley .. thanks a lot
WorldMaker 10mo ago
Deno does that. It also refrains from keeping a local node_modules at all until/unless you explicitly ask it to for whatever compatibility reason. There are plugins to things like esbuild to use the Deno resolver and not need a node_modules at all (if you aren't also using the Deno-provided bundler for whatever reason such as it disappeared for a couple versions and is still marked "experimental").
user34283 10mo ago
I decided to stick with Node in general. I don't see any compelling reason to change it. Faster install and less disk space due to hardlink? Not really all that important to me. Npm comes with a cache too, and I have the disk space. I don't need it to be faster. With the old-school setup I can easily manually edit something in node_modules to quickly test a change. No more node_modules? It was a cool idea when yarn 2 initially implemented it, but at the end of the day I prefer things to just work rather than debug what is and isn't broken by the new resolver. At the time my DevOps team also wasn't too excited about me proposing to put the dependencies into git for the zero-install.

homebrewer 10mo ago

pnpm does all that on top of node. Also disables postinstall scripts by default, making the recent security incidents we've seen a non-issue.

antihero 10mo ago
I’m not sure why but bun still feels snappier.
- B56b 10mo ago
  This is why: https://bun.com/blog/behind-the-scenes-of-bun-install https://bun.com/blog/behind-the-scenes-of-bun-install
- babyshake 10mo ago
  Aside from speed, what would the major selling points be on migrating from pnpm to bun?
daheza 10mo ago
Are there any popular packages that require postinstall scripts that this hurts?
junon 10mo ago
As the victim of the larger pre-Shai-Hulud attack, unfortunately the install script validation wouldn't have protected you. Also, if you already have an infected package on the whitelist, a new infection in the install script will still affect you.
replete 10mo ago
A whitelist in package.json is only a partial assist

satvikpendem 10mo ago

Deno does all that. Hell, yarn does too, or pnpm as the sibling mentioned.

FINDarkside 10mo ago
Sure, but pnpm is very slow compared to bun.

agumonkey 10mo ago

IIRC bun zig code base has a lot of fine optimization too. I think the lead did a conference explaining his work. Or maybe i'm confused.

dolmen 10mo ago
https://bun.com/blog/behind-the-scenes-of-bun-install https://bun.com/blog/behind-the-scenes-of-bun-install
- agumonkey 10mo ago
  oh thanks yes, i couldn't find it, i was already lost thinking it was a conference by andrew kelley .. thanks a lot

WorldMaker 10mo ago

Deno does that. It also refrains from keeping a local node_modules at all until/unless you explicitly ask it to for whatever compatibility reason. There are plugins to things like esbuild to use the Deno resolver and not need a node_modules at all (if you aren't also using the Deno-provided bundler for whatever reason such as it disappeared for a couple versions and is still marked "experimental").

user34283 10mo ago

I decided to stick with Node in general. I don't see any compelling reason to change it. Faster install and less disk space due to hardlink? Not really all that important to me. Npm comes with a cache too, and I have the disk space. I don't need it to be faster. With the old-school setup I can easily manually edit something in node_modules to quickly test a change. No more node_modules? It was a cool idea when yarn 2 initially implemented it, but at the end of the day I prefer things to just work rather than debug what is and isn't broken by the new resolver. At the time my DevOps team also wasn't too excited about me proposing to put the dependencies into git for the zero-install.