Dependency hell & package management

I think Go apps tend to have better dependency hygiene because the language has a better standard library, which results in better culture around dependencies. I also think it’s frustrating that both cargo and npm totally ignore the decades of prior art from Linux distributions that have figured out good ways to improve dependency management.

segphault · Aug 20, 2026 · comment in “Malicious Rust crate Arrayref runs a build-time payload”

I wanted it, but only for this one niche use case. It was a GUI client to manage a collection of repos, about 200 of them in a monorepo where every subproject was a git submodule , which are the universal counterpart to node_modules — while the latter is notorious for being "the heaviest object in the universe", git submodules are widely acknowledged to be the most annoying objects in the universe.

veidr · Jun 6, 2026 · comment in “Ask HN: What was your "oh shit" moment with GenAI?”

agent-safehouse (https://agent-safehouse.dev) was my answer to this. I was using Docker containers for sandboxing but it was annoying at times, not so much for the performance hit (which wasn’t noticeable running in OrbStack) but various little papercuts like no shared clipboard, node_modules pulling in Linux binaries or macOS binaries depending on whether I ran npm install from inside the sandbox or my own shell, e…

lukebyear · Apr 8, 2026 · comment in “Slightly safer vibecoding by adopting old hacker habits”

Show HN: Workz–Git worktrees with zero-config dep sync and a built-in MCP server I built workz to solve a daily frustration: git worktree add drops you into a directory with no .env, no node_modules, and 2GB of disk wasted per branch if you reinstall.

rohansx · Mar 2, 2026 · story in “Show HN: Workz–Git worktrees with zero-config dep sync and a built-in MCP server”

Six months later, those pinned versions have known CVEs, are approaching end-of-life, or have breaking changes queued up. The person who built it doesn't understand the dependency tree because they never chose those dependencies deliberately — the LLM did.

matheus-rr · Feb 15, 2026 · comment in “Breaking the spell of vibe coding”

You would find it funny but the problem's not in code generation but dependency management etc. atleast to me which is why I love uv scripts a lot but sometimes especially chatgpt doesn't know about uv script feature or hallucinates it hard on their web version so If I am building python applets I would paste uv script's complete docs to the LLM website I would be using.

Imustaskforhelp · Jan 21, 2026 · comment in “The percentage of Show HN posts is increasing, but their scores are decreasing”