grpc-node icon indicating copy to clipboard operation
grpc-node copied to clipboard

Remove @grpc/proto-loader from @grpc/grpc-js

Open polRk opened this issue 9 months ago • 2 comments

Is your feature request related to a problem?

Right now, the grpc-js package is install the proto-loader package (which I'm 100% sure it doesn't need). I suggest removing the proto-loader package from the grpc-js dependencies.

Describe the solution you'd like

To import channelZ (if someone needs it), grpc-js can use code generation of any of dozens of other packages that create physical files and can work in environments where there is no node_modules folder. In this way, we will fix two problems - unnecessary dependency and work in production environments (where the use of node_modules is prohibited and there are requirements for bundling the application into a single js file)

Describe alternatives you've considered

protobufjs-cli, protobuf-ts, @bufbuild/protobuf and many others.

Additional context

See how many unnecessary dependencies I need to install: https://npmgraph.js.org/?q=%40grpc%2Fgrpc-js. And every such unnecessary dependency is a potential place to attack.

Notes

For me, i can "omit" via overrides:

"@grpc/proto-loader": "npm:dry-uninstall"

polRk avatar Apr 16 '25 07:04 polRk

Which of those alternative implementations generates code with no runtime dependencies? I admit that I haven't tried many of them, but I know that protobufjs-cli generates code that depends on the protobufjs package.

murgatroid99 avatar Apr 16 '25 16:04 murgatroid99

`` generates code that depends on the protobufjs package.

That's fine, just one package.

protobufjs-cli + protobufjs/minimal protobuf-ts + @protobuf-ts/runtime protobuf-es + @bufbuild/protobuf

polRk avatar Apr 19 '25 15:04 polRk