app-config icon indicating copy to clipboard operation
app-config copied to clipboard

Lightweight version for Node.js backend

Open dec0dOS opened this issue 9 months ago • 0 comments

When installing the @app-config/main@2 package, you might notice some warnings and a substantial number of dependencies being added:

❯ npm install @app-config/main@2
npm WARN deprecated [email protected]: Please switch to @apidevtools/json-schema-ref-parser
npm WARN deprecated @types/[email protected]: This is a stub types definition. BSON provides its own type definitions, so you do not need this installed.

added 239 packages, and audited 240 packages in 18s

19 packages are looking for funding
  run `npm fund` for details

6 high severity vulnerabilities

To address all issues, run:
  npm audit fix

Run `npm audit` for details.

While the app-config library is fantastic, it might seem excessive if you simply want to load and validate configuration files for your Node.js backend. The surplus dependencies can introduce supply chain risks and increases the container image, and the presence of high-severity vulnerabilities in deprecated packages can be concerning.

This issue is particularly relevant for Node.js backend servers, where you don't need the CLI or other unnecessary dependencies on your production server. Instead, these should be declared as devDependencies.

I'd like to inquire if there are any plans to introduce a more lightweight solution tailored for Node.js. This would greatly benefit users who want a simpler, streamlined approach to config loading and validation for their backend servers.

dec0dOS avatar Sep 18 '23 23:09 dec0dOS