#2 [Stackless] Praise for packages
Hi reader!
This is issue #2 of The Stackless Newsletter.
JavaScript is about to change. On March 2, the newest version of the Chrome web browser ships with import maps, a language feature that seems obscure but is key to buildless JavaScript.
No more Node or NPM for browser JavaScript. To install libraries of third-party code, we use NPM for server-side JavaScript, which is the package manager for Node. To get packages in browser JavaScript, we 1) install Node and NPM, 2) create a package.json file, 3) install packages using npm or Yarn, 4) and use Webpack or Rollup or Parcel to bundle JS for use in the browser. Import maps are about to change that. I'll explain why, but first I want to highlight the importance of packages and look at the problem of package management in the browser.
Praise for packages. In a world without packages, there would be no easy way to include other people's code in our projects. Without pre-made libraries, we might code everything from scratch (or find code examples and paste them into our projects by hand as programmers did in the 1980s). For the way we code today, we have package repositories and package managers, making it easy for us to use other people's code.
What a package manager does. Package managers do three things: downloading, file management, and dependency management. Package managers need a "shopping list" of a project's third-party libraries (in Node, a package.json; in Ruby, a Gemfile), with information about the source for packages (a registry like npmjs.com or rubygems.org). After downloading, the package manager unpacks and saves the files in an organized way. Finally (and this is the hard part), a package manager installs the correct version of each dependency that is needed for any package.
Why no JavaScript package manager? Every mature language has a package manager. There is Bundler (for Ruby), PyPI (for Python), and Composer (for PHP). JavaScript has no built-in package manager because it was designed to run in the browser without access to a computer's file system (for security). When JavaScript was adapted as Node for servers, developers added NPM, the Node Package Manager.
Node and NPM are add-ons. If JavaScript were the automotive industry, Node and NPM would be aftermarket products. They don't ship with the vehicle; we install them later. Things began to change with the ES6 Javascript import statement, which made it possible to load packages using a URL. With URLs, the browser can load third-party code from module CDNs such as JSPM or Skypack, without Node and NPM.
Why does it matter? If package management becomes part of a language's standard features, aftermarket parts aren't needed. The language is easier to use and there are fewer moving parts to maintain.
Version pinning. There's just one problem using module CDNs to load third-party packages. Right now, the only way to control which version you request is to specify the version number in the URL. That's inconvenient. Changing versions requires search-and-replace in every file that uses the package. That's a problem that import maps will solve.
The road to buildless JavaScript. Import maps provide version pinning. Using Chrome, starting next week, we can conveniently specify the exact version of any package and load it from a module CDN without a need for Node and NPM. I'll show you code examples in the newsletters to come.
Please hit reply and email me if you have questions, suggestions, or objections. I want to hear from you!
Best wishes from Bali,
Daniel
Web links of the week
How Web Components Are Used at GitHub and Salesforce
Richard MacManus followed up his article on Web Frameworks: Why You Don’t Always Need Them by talking to engineers about web components at GitHub and Salesforce.
The Future of Web Software Is HTML-over-WebSocket Lots of talk about this article by Matt E. Patterson on Hacker News and elsewhere. It praises Hotwire, the new magic in Rails, and reflects an eagerness among some developers to rely less on JavaScript frameworks and do more with the server-side frameworks.