Last month I announced my latest venture to support the Ruby open source community: the Gem Fellowship. I want this grant program to support and fund existing Ruby-related open source project maintainers and their ongoing efforts: fixing bugs and adding features for those libraries we know and love.

test cases documentation

AGDQ 2026 Pre-Show benefiting Prevent Cancer Foundation !donate !schedule

I have walked the circles of JavaScript dependency hell. I watched the developers solve each problem, only to create the next. Come, I will show you what I have seen. ### 1. Limbo No package manager. Copy-paste jQuery into your project. Download tarballs. Vendor everything. _Solution:_ npm makes publishing trivial. ### 2. Lust Frictionless publishing. One-line packages, is-odd, left-pad. Why write four lines when you can import? _Solution:_ Embrace it. Automatic transitive resolution. ### 3. Gluttony I put the gluttons in freezing mud, pelted by rain. Here, they drown in node_modules. One import becomes 1,400 packages. Heaviest objects in the universe. _Solution:_ Better dependency resolution. ### 4. Wrath Version conflicts. A needs lodash@3, B needs lodash@4. Resolver errors, build failures. _Solution:_ Allow multiple versions simultaneously. ### 5. Greed The automation treadmill. Ecosystem moves so fast you need bots to keep up. semantic-release to automate publishing, Dependabot and Renovate to automate consuming. Hundreds of PRs per week. Merging without reading. Running to stand still. _Solution:_ Let tools handle it. Yarn promises better performance and determinism. ### 6. Heresy The schisms. Yarn, pnpm, Bun. Four lockfile formats, four CLIs. Community splits, the problems just moved. _Solution:_ At least everyone still uses the same registry. Centralize trust there. ### 7. Fraud I put the flatterers in excrement. npm audit does the same. Security theater screaming about dev dependencies. CVE fatigue. Everyone clicks dismiss. _Solution:_ Trust the pipeline. Many eyes make bugs shallow. ### 8. Violence Worms. Not just trojans but self-propagating attacks through the dependency graph. Compromise one maintainer, spread to thousands of downstream packages automatically. The spice must flow. _Solution:_ Trusted publishing. OIDC tokens. Let GitHub Actions handle it. ### 9. Treachery The machines. AI agents that `npm install` without reading. LLMs hallucinating package names that don’t exist, until a squatter registers them because Claude keeps asking. Prompt injection in README files. `postinstall` scripts running unsupervised. The dependency graph isn’t just the attack surface now. It’s the context window. At the bottom, Satan runs `npm install` forever. The agents have joined him.