Webtorrent: Dependency hygiene

[feross]

I want to go through the whole webtorrent dependency tree to:

• De-duplicate dependencies
• Ensure that we're using the latest version
• Pruning dependencies that aren't needed in modern JS environments (to reduce risk and increase install speed)

This issue is a placeholder to track this task.

I'm tracking progress on this work in this issue: https://github.com/brave/brave-browser/issues/5490

[feross]

One nice side effect of this effort. So far I've been able to reduce the bundle size by 10KB!

From 98338 bytes to 88915 bytes, so far.

Should get quite a bit smaller once https://github.com/browserify/browserify/pull/1916 is merged.

[RecoX]

One nice side effect of this effort. So far I've been able to reduce the bundle size by 10KB!

From 98338 bytes to 88915 bytes, so far.

Should get quite a bit smaller once browserify/browserify#1916 is merged.

Is it worth all the effort put it on this to just reduce the bundle by 10kb?

Just asking because my lack of knowledge.

[feross]

Is it worth all the effort put it on this to just reduce the bundle by 10kb?

Depends on your priorities. Small size has always been one of my priorities with WebTorrent. It's one of the best parts of WebTorrent – that it's small and carefully selects dependencies. Lots of others decentralized web projects require 2MB+ of JavaScript and don't work nearly as well as WebTorrent does. The fact that we can fit a whole torrent client into <100KB is amazing.

Also, updating dependencies gives us bug fixes, wards off potential security issues, and makes installation faster.

[ExE-Boss]

I recommend using pnpm as the package manager, as it avoids “phantom dependency” and “npm doppelganger” problems by using symlinks, hardlinks and isolated trees.

“npm doppelgangers” in particular are a common‑ish cause of exploding bundle sizes.

[feross]

“phantom dependency”

This is a valid issue that can sometimes happen but I'll be adding a rule to standard to catch this in a future version and it doesn't seem to have anything to do with bundle size?

“npm doppelganger”

This is not a problem with browserify since it hashes every required file and never includes a duplicate.