Commit

WildflowerJS was developed from the starting principle of "no build step, ever." And this was initially because I just despise that front-end development had become so unnecessarily complicated and HTML/JS had become target code instead of what was directly used for development. But it quickly became clear that there was another significant benefit: security. With no dependency tree, you avoid all the attack vectors that come with it. Attack vectors that are completely tangential to your work, that are there for no other reason than your framework of choice requires the dependency tree. Our distros that come with each release (different sizes for different needs) are all built with no dependency tree, as well. We use 3 frozen tarballs, SHA-512-pinned: rollup 3.30.0, terser 5.46.2 and acorn 8.16.0. We don't pull in the source-map packages that are normally required by terser, so just those 3. So when you see a new NPM exploit, like Shai Hulud, Node2Shell, or HTTP2Shell, consider that for most of what you need to do on the front end, NPM never has to be part of your workflow. If you don't want it to be. And if you're coming to grips with its inherent fragility, maybe it shouldn't be.