Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Lightweight version for Node.js backend #227

Open
dec0dOS opened this issue Sep 18, 2023 · 0 comments
Open

Lightweight version for Node.js backend #227

dec0dOS opened this issue Sep 18, 2023 · 0 comments

Comments

@dec0dOS
Copy link

dec0dOS commented Sep 18, 2023

When installing the @app-config/main@2 package, you might notice some warnings and a substantial number of dependencies being added:

❯ npm install @app-config/main@2
npm WARN deprecated [email protected]: Please switch to @apidevtools/json-schema-ref-parser
npm WARN deprecated @types/[email protected]: This is a stub types definition. BSON provides its own type definitions, so you do not need this installed.

added 239 packages, and audited 240 packages in 18s

19 packages are looking for funding
  run `npm fund` for details

6 high severity vulnerabilities

To address all issues, run:
  npm audit fix

Run `npm audit` for details.

While the app-config library is fantastic, it might seem excessive if you simply want to load and validate configuration files for your Node.js backend. The surplus dependencies can introduce supply chain risks and increases the container image, and the presence of high-severity vulnerabilities in deprecated packages can be concerning.

This issue is particularly relevant for Node.js backend servers, where you don't need the CLI or other unnecessary dependencies on your production server. Instead, these should be declared as devDependencies.

I'd like to inquire if there are any plans to introduce a more lightweight solution tailored for Node.js. This would greatly benefit users who want a simpler, streamlined approach to config loading and validation for their backend servers.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant