discussion with NPM on depenedent module statistics

[ghinks]

Although we are looking into dependency tooling currently. I would like to engage @darcyclarke @ahmadnassri @ruyadorno in order to see if any existing module dependency statistics could be made available to the maintenance team while we develop tooling.

The basic issue we wish to solve

How do we find the top modules that depend on a module we are starting to maintain?

I am taking this from a very practical perspective and an example helps. The express-session module has over 3k dependents. I am starting to triage that module as part of the express triage team. We are forming the framework for repo captains who can help manage different repositories within the express eco system.

There are many 3rd party module dependencies and some of them I can guess are more important than others. eg

• connect-redis
• connect-mongo

however I am being biased and looking for the modules I think of. There are most likely hundreds of modules that connect to DB storage that use the express-session module.

Would it be possible to get an ordered dependency list from the registry folks and is there a better way to do this than scrapping the registry?

As we start to maintain import libraries in the eco-system we will have to test changes in the dependents. Without clear understanding of what modules are important this will lead to de-stabilization through well intentioned maintenance changes.

[ljharb]

It's not going to be effective to use any API, github or otherwise, that doesn't filter to direct deps only. I believe github includes all transitive deps.

[ruyadorno]

hi @ghinks I opened an issue over at npm/rfcs#125 so that we make sure we discuss it during the next meeting.
If we can get some folks from the package-maintenance WG to participate in an OpenRFC call that would be great to hear your thoughts and make sure it gets traction 😊

[ghinks]

🙏🏻

[ljharb]

@ruyadorno i'll be there