WOW.

I've been doing the exact opposite for a long time now.

Specifically with Nuget packages, because I could just trust that the package would be there.

Considering that node_modules often has something like 4000 files in it, this seems like a huge problem to me. Especially considering the amount of redundancy in node_modules.

Uggh... unfortunately if the trust of the package distribution sites is violated then there's no other choice than to check in dependencies.

:(

I'm not happy about this at all.

actually quite convenient: besides having piece of mind, it really simplifies builds and deploy, all for the cost of a few extra mb in your git

Then how can you ever install anything in the first place?

Having no understanding of the broader js context I assumed the comment to mean "all library dependencies should be checked in, build tools should be defined & specified & able to fully recreate the build given they are installed".

For the record this is a well known & frequently advocated for build pattern.

Fair enough, I guess I was just thinking of the issue I'd run into with trying to actually install anything in the first place.

In the case of npm though, installation brings down a lot of files so it's not super efficient. I've installed 15 packages and have over 12,000 files (75MB) to show for it.

this is not a serious burden on git, plus they will rarely change

You can still do npm install / npm update, just do git add -A node_modules && git commit right after.