Audit npm dependencies

• Removed unused dependencies
• Find alternatives to modules which use native dependencies wherever possible
• Replace some dependencies with simpler local components
• Update (npm outdated) remaining modules

/cc @mewtaylor @rschamp

[rschamp]

The only difference I see between Object.assign and lodash.defaults is the order the source object attributes are applied, but they can achieve the same thing. The way we use lodash.defaults, we expect arguments to be mutated, e.g. https://github.com/LLK/scratch-www/blob/99c76ee3bfd29e8ffb05cc7fc9a987019a7cef66/src/lib/api.js#L18-L23, so I think they’re equivalent in that way.

I don’t think you can use the mutating method of Object.assign in the same way as lodash.defaults, since the target values will always be overwritten by the source (rather than just treating them as defaults). E.g.,

var opts = {a: 1, b: 2, c:3};
defaults(opts, {a: 'a', b: 'b', c: 'c', d: 'd'});
// {a: 1, b: 2, c: 3, d: 'd'}
// opts = {a: 1, b: 2, c: 3, d: 'd'}

Object.assign(opts, {a: 'a', b: 'b', c: 'c', d: 'd'});
// {a: 'a', b: 'b', c: 'c', d: 'd'}
// opts = {a: 'a', b: 'b', c: 'c', d: 'd'}

Object.assign({a: 'a', b: 'b', c: 'c', d: 'd'}, opts);
// {a: 1, b: 2, c: 3, d: 'd'}
// opts = {a: 1, b: 2, c:3} (unchanged)

// Equivalent to lodash.defaults
opts = Object.assign({a: 'a', b: 'b', c: 'c', d: 'd'}, opts);
// {a: 1, b: 2, c: 3, d: 'd'}
// opts = {a: 1, b: 2, c: 3, d: 'd'}

But to me, this is actually a good thing about Object.assign, because functions that mutate arguments can lead to unexpected behavior.

I am for removing lodash.defaults in favor of Object.assign if we can achieve the same thing with both (in general, I’m for replacing any dependency with an equivalently convenient Javascript implementation if possible). Then whenever we use this functionality, we won’t have to install a dependency in every codebase. This is with the understanding that lodash.defaults isn’t going to change much, and doesn’t matter too much as a dependency. Mostly just that if we can have consistent idioms in our code across codebases without using a dependency, then we should do that. Curious though what @thisandagain and @mewtaylor think of this.

I agree @mewtaylor I think we should keep react-formsy around until it causes us problems.

[rschamp]

We should also enable Greenkeeper.