zlacker

I haven't used Deno, but I do use Bun purely as a replacement for npm. It does the hard-linking thing that seems to be increasingly common for package managers these days (i.e. it populates your local node_modules with a bunch of hard links to its systemwide cache), which makes it vastly quicker and more disk-efficient than npm for most usage.

Even with a cold cache, `bun install` with a large-ish dependency graph is significantly faster than `npm install` in my experience.

I don't know if Deno does that, but some googling for "deno install performance vs npm install" doesn't turn up much, so I suspect not?

As a runtime, though, I have no opinion. I did test it against Node, but for my use case (build tooling for web projects) it didn't make a noticeable difference, so I decided to stick with Node.

>>TheFly+(OP)
pnpm does all that on top of node. Also disables postinstall scripts by default, making the recent security incidents we've seen a non-issue.

>>homebr+e4
I’m not sure why but bun still feels snappier.

>>TheFly+(OP)
Deno does all that. Hell, yarn does too, or pnpm as the sibling mentioned.

>>homebr+e4
Are there any popular packages that require postinstall scripts that this hurts?

>>antihe+Y5
This is why: https://bun.com/blog/behind-the-scenes-of-bun-install

>>TheFly+(OP)
IIRC bun zig code base has a lot of fine optimization too. I think the lead did a conference explaining his work. Or maybe i'm confused.

>>antihe+Y5
Aside from speed, what would the major selling points be on migrating from pnpm to bun?

>>TheFly+(OP)
Deno does that. It also refrains from keeping a local node_modules at all until/unless you explicitly ask it to for whatever compatibility reason. There are plugins to things like esbuild to use the Deno resolver and not need a node_modules at all (if you aren't also using the Deno-provided bundler for whatever reason such as it disappeared for a couple versions and is still marked "experimental").

>>homebr+e4
As the victim of the larger pre-Shai-Hulud attack, unfortunately the install script validation wouldn't have protected you. Also, if you already have an infected package on the whitelist, a new infection in the install script will still affect you.

>>satvik+q6
Sure, but pnpm is very slow compared to bun.

>>agumon+ui
https://bun.com/blog/behind-the-scenes-of-bun-install

>>TheFly+(OP)
I decided to stick with Node in general. I don't see any compelling reason to change it.

Faster install and less disk space due to hardlink? Not really all that important to me. Npm comes with a cache too, and I have the disk space. I don't need it to be faster.

With the old-school setup I can easily manually edit something in node_modules to quickly test a change.

No more node_modules? It was a cool idea when yarn 2 initially implemented it, but at the end of the day I prefer things to just work rather than debug what is and isn't broken by the new resolver. At the time my DevOps team also wasn't too excited about me proposing to put the dependencies into git for the zero-install.

>>dolmen+LW
oh thanks yes, i couldn't find it, i was already lost thinking it was a conference by andrew kelley .. thanks a lot

>>homebr+e4
A whitelist in package.json is only a partial assist