Bundle production dependencies

ESLint is used only in development environment. It is a popular tool with well maintained tests suit. As such, I think it would benefit from using NPM bundledDependencies package.json property. Specifically, this would make the install time of ESLint a lot faster and would lift restrictions of the modularisation.

The build process can be automated to include all production dependencies. A simple NPM script can be used to streamline the process:

{
    "bundle-dependencies": "bundled-dependencies",
    "bundle-prepare": "npm run bundle-dependencies; git commit -m 'Updated bundle dependencies.' ./package.json; rm -fr ./node_modules; npm install --production; npm publish; npm install;"
}

An example of a package using bundledDependecies is canonical. To experience the benefits, try to install canonical version that is using bundledDependecies (3.0.0+) and compare it against a version that is not using it (2.5.0). Here are the test results on my machine:

npm install canonical@3.0.1

10.81s user
4.45s system
110% cpu
13.790 total

npm install canonical@2.5.0

13.17s user
2.77s system
27% cpu
58.136 total

<bountysource-plugin>

Want to back this issue? Post a bounty on it! We accept bounties via Bountysource. </bountysource-plugin>

[BYK]

it’s starting to seem like this is the right choice for keeping our users safe.

I’m not sure if I really agree with this. If our users are relying on NPM to download us, then bundling dependencies is only a partial solution where the real problem resides in NPM itself. I think this is something NPM should resolve, not us. Unless people complain about this kind of events more I’m 👎 for this proposal.

[nzakas]

Given recent events (http://www.theregister.co.uk/2016/03/23/npm_left_pad_chaos/), I think we should strongly consider doing this. It would scratch two itches:

1. Locking down dependencies so the ones we use while publishing are the ones people get
2. Preventing deletion of a dependency from breaking our users

It looks like there are some unclear perf implications to this, but even so, it’s starting to seem like this is the right choice for keeping our users safe.

@eslint/eslint-team other thoughts?