#1030952 npm depends on webpack and 200+ other packages

Package:
npm
Source:
npm
Submitter:
Christopher Hagar
Date:
2023-07-11 19:15:03 UTC
Severity:
normal
#1030952#5
Date:
2023-02-09 21:35:30 UTC
From:
To:
After recent changes in npm and node-css-loader (node-postcss-selector-parser),
installing npm installs webpack and 200+ other node-related packages.

Given that npm is a package manager, it should not require so many
dependencies.

Morever, npm is for installing packages outside of the Debian package manager!
It should not bring in tons of Debian packages that will never be used.

Debian Policy says that Depends declares an "absolute dependency". Recommends
declares a "strong, but not absolute, dependency". Suggests declares that a
packages "may be more useful with one or more others". And it is possible there
should be no dependency relationship of any kind for npm depending on webpack.
#1030952#10
Date:
2023-02-10 03:09:34 UTC
From:
To:
Control: reassign -1 node-postcss-selector-parser

if you install upstream npm, you'll have hundreds packages in
npm/node_modules (around 200 MB). The way chosen in Debian is to reuse
modules that already exist in Debian (and then drop them from npm).
So yes, there are a lot of dependencies but /usr/share/nodejs/npm (and
related dirs like  @npmcli/) contains only 3 MB including
/usr/share/nodejs/npm/node_modules/.

Anyway npm doesn't need webpack.
Link between npm and webpack:
  - npm requires node-postcss-selector-parser (for @npmcli/query)
  - node-postcss-selector-parser requires node-css-loader because it
    requires node-indexes-of which is a virtual package provided by
    node-postcss-selector-parser
  - node-css-loader requires webpack

So the bug is in node-postcss-selector-parser, it may embed indexes-of
which is a 5-lines modules instead of depending of node-css-loader.
#1030952#19
Date:
2023-02-10 03:22:41 UTC
From:
To:
Control: reassign -1 node-css-loader

I'm wrong here, node-postcss-selector-parser is a virtual package
provided by node-css-loader.
#1030952#28
Date:
2023-07-11 19:05:54 UTC
From:
To:
I'm unfamiliar with the Debian JS packaging process, but based on a
quick search on npm, it would seem to me that this could be quite simple
to resolve: Turn node-postcss-selector-parser into a concrete package,
which would then contain only node-postcss-selector-parser, and depend
on node-util-deprecate and node-cssesc (the latter being a virtual
package provided by node-css-selector-tokenizer).

I'm sure I'm not the only one with node-css-loader pinned at 5.0.1 to
avoid installing webpack just for npm, so would enjoy seeing this fixed.