question-mark
Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Reign in Ganache-Core dependencies.

See original GitHub issue

I just did npm install ganache-core and it brought in:

added 1642 packages from 1150 contributors and audited 46082 packages in 36.351s found 11 vulnerabilities (10 low, 1 high) run npm audit fix to fix them, or npm audit for details

1642 dependencies is insanity and should be reigned in. While I understand this is a pretty big project, that is a crazy number of dependencies. Also, the more dependencies you have the more vulnerabilities there will be. Since this is a test library it isn’t that big of a deal except that it contributes to training users to ignore GitHub vulnerability warnings and can potentially obscure actual vulnerabilities due to having to mentally ignore all of the vulnerabilities from packages brought in by ganache-core.

Also, those 1642 dependencies account for ~166 MB of disk space and bandwidth to fetch, more if you count headers (bandwidth) and block sizes (disk space).

Surely, there is room to trim down some of this cruft?

Issue Analytics

  • State:closed
  • Created 3 years ago
  • Reactions:2
  • Comments:5 (5 by maintainers)

github_iconTop GitHub Comments

1reaction
davidmurdochcommented, Apr 16, 2020

We plan on removing web3 from production in the future.

0reactions
davidmurdochcommented, Feb 1, 2021

Fixed in next major release. Created new problem whilst fixing: https://github.com/trufflesuite/ganache-core/issues/744

Read more comments on GitHub >

github_iconTop Results From Across the Web

@ganache/core - npm
A library to create a local blockchain for fast Ethereum development.. Latest version: 0.5.1, last published: 10 days ago.
Read more >
ganache-core | npm - Open Source Insights
We found errors while resolving dependencies that may result in an incomplete or inaccurate dependency graph. Show details. Errors found while ...
Read more >
kevm-ganache-core - npm Package Health Analysis - Snyk
This repository was forked from ganache-core. This package is not indended to be used individually, but as a dependency for kevm-ganache-cli .
Read more >
Ganache - Truffle Suite
BLOCKCHAIN LOG OUTPUT. See the log output of Ganache's internal blockchain, including responses and other vital debugging information. ADVANCED MINING CONTROLS.
Read more >
trufflesuite/ganache-cli - Docker Image
ganache-cli utilizes ganache-core internally, which is distributed with optional native dependencies for increased performance. If these native dependencies ...
Read more >

github_iconTop Related Medium Post

No results found

github_iconTop Related StackOverflow Question

No results found

github_iconTroubleshoot Live Code

Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free

github_iconTop Related Reddit Thread

No results found

github_iconTop Related Hackernoon Post

No results found

github_iconTop Related Tweet

No results found

github_iconTop Related Dev.to Post

No results found

github_iconTop Related Hashnode Post

No results found