Large dependency graph

[kachkaev]

👋 folks! I’ve just tried manypkg instead of check-dependency-version-consistency – looks great!

There is a minor internal issue I would like to bring up. Installing @manypkg/[email protected] adds quite a lot of transient dependencies some of which are quite dated. An example would be [email protected] that has not been updated for six years.

Because of that, the lock file gets quite polluted. Here is my diff after swapping check-dependency-version-consistency with @manypkg/cli (quite a lot of new stuff):

Because the new dependency graph is quite big and parts of it are dated, there is a risk of bumping into security advisories that will be hard to address. It’d be great if the number of deps could be made smaller and libraries like spawndamnit could be replaced with something else, if possible.

Despite this small concern, great tool folks! I really like the simplicity of the DX you’ve created!

[Andarist]

We could accept a PR swapping this dependency for a lighter alternative. I'm not sure what that alternative would be though.