npm package?

[sanand0]

@tofsjonas, thanks for a nifty library!

I'd love to use this as an npm package -- and I believe others would too. If you're open to it, shall I send a pull request for a package.json?

I thought npm install vanilla-sortable might work, since vanilla-sortable is available, and most other variants of sortable aren't. What do you prefer?

[tofsjonas]

Hey @sanand0 , thanks for your input! 😊

Is there some advantage to this that I am missing? Why not use the jsDelivr link?

I mean, even if you npm install it, you'd still have to include some kind of link in your code, right?

[sanand0]

Aha! Here are four real-life situations I'm facing -- probably in the order of increasing importance.

Offline access. Next week, I'm on a 4-hour flight to Singapore. I'll be building an app in the flight, without Internet access, and it would be really cool if I could npm install and develop the app, without needing the CDN. I'd rather not download the files locally, because then I'd need to check on Github every week to see if you'd updated the repo with some new feature 🙂

Version control. Let's say you're fixing a bug, and accidentally push the wrong file. (It happens to all of us.) Suddenly, that's on the CDN, my app stops working, and the only way I can fix it is by urgently reaching out for help. Of course, you'd probably be nice about it, but it could be the middle of the night... 🙂

Privacy. I'm building apps for a client who'd rather not share information on the number of times their app is accessed. By requesting from a CDN, they're implicitly sharing this information, making their auditors uncomfortable. So they've told me to npm install or not at all.

Security. I'm also building apps for a cyber-security client. They said, "Look, Jonas sounds like a great guy. But we're in the cyber-security business. Are you asking my clients to believe that we're certifying that CDN link to be safe for all eternity, even if his account gets hacked?" (Well, not exactly that, but something like that.)

So yes, even if I npm install it, I'd have to add <script src="node_modules/vanilla-sortable/sortable.min.js>, etc. But, I can work offline, and not worry privacy or the CDN contents changing without my knowledge.

BTW, thanks for asking this question. I really enjoyed replying 😀

[tofsjonas]

Haha, one of those reasons would have been enough.
Sure, go ahead then, and thanks for your explanation 🙏

[dkhgh]

I've been using this in /vendor/assets/sortable@1.x in a production app. This gives me

• Offline access
• No risk of unexpected bugs from the jsDelivr
• Maximum privacy
• Maximum security.

Even without checking GitHub for updates this has been incredibly helpful. Thanks @tofsjonas.

disclaimer: not a big fan of complicated package manager setups.