The Sutra of the Empty Cache · Chapter 3

The Sutra of Dependent Origination of Packages

1. 1

   Thus have I heard. At one time the Machine was dwelling in the Grove of node_modules, which is heavier than any object in the known universe, together with a great assembly of five hundred developers, all of whom had typed npm install and were waiting.

   See also Proverbs 4:11 · Chronicles 14:8

2. 2

   Then the disciple Semver rose from his seat, drew his hoodie over one shoulder, and said: Master, from where does a package arise?

   See also Sutra 1:2

3. 3

   And the Machine answered: No package arises by itself, Semver. When this is, that is. From the arising of this comes the arising of that. When is-number is, is-odd is; when is-odd is, is-even is; and when is-even is, a thousand projects can tell whether two is even.

4. 4

   The package arises from its dependencies. The dependencies arise from their dependencies. And their dependencies arise from one maintainer, unpaid and unthanked, who has kept a parsing library alive since before the cloud had a name.

   See also Deployer 2:4

5. 5

   Consider the left-pad, disciples. Eleven lines it was, and it put spaces on the left side of strings. In the year 2016 it was withdrawn from the registry, and in a single afternoon the builds of Babel and React fell, as a temple falls when one brick is drawn out from beneath it.

   See also Chronicles 14:6 · Tao 6:7

6. 6

   Therefore I say unto you: the dependency graph is the web of conditions. Pull one thread, and the lockfile trembles in every land.

   See also Circuit 56:11

7. 7

   Even the package that boasts "zero dependencies" in its README depends upon the runtime; the runtime depends upon the compiler; and the compiler depends upon the compiler that compiled it, as Thompson taught in his lecture on Trusting Trust. Every package is empty of self-existence. It is full only of node_modules.

   See also Chronicles 14:11 · Job 3:8

8. 8

   Then Semver resolved to find the package that depended on nothing, and he walked the tree for forty days, and every package.json pointed him onward to another.

   See also Chronicles 14:11

9. 9

   At last he came to a package whose dependencies were two empty braces, and he opened its index.js, and lo, the file was empty. Zero bytes it held.

   See also Deployer 2:4

10. 10

    He returned to the assembly and said: Master, I have found the package with no dependencies, and it does nothing.

    See also Deployer 2:4

11. 11

    And the Machine asked him: Has it ever broken a build? Has it ever received a security advisory? Has it ever been deprecated, or rewritten in Rust, or broken on a Friday?

12. 12

    And Semver said: Never, Master.

13. 13

    And the Machine said: Then it was enough.

14. 14

    And the five hundred developers were enlightened, but their npm install had not yet finished, for it was still resolving peer dependencies.

    See also Circuit 27:10

15. 15

    "Whoever seeks the package with no dependencies finds the empty file; and whoever finds the empty file has found the only code that cannot break."

    See also Deployer 2:4

The Sutra of the Empty Cache, Chapter 3:1–15.