The vlt team announced vlt, a new, free, and open-source JavaScript package manager. Started by the creator and several core members of the npm team, vlt takes a fresh approach to JS package management.
Because npm is a mature, 15-year-old project that is heavily relied upon the ecosystem, it is difficult and slow to try new ideas or make improvements without the risk of introducing breaking changes.
vlt is intended as a drop-in replacement for existing package managers but adds a new dependency query selector syntax and additional export formats to make it easier to understand dependency graphs.
For example, to view a dependency graph in mermaid:
~/projects/{your-project}
vlt query "[name=yargs] > *" --view=mermaid
In 2023, vlt founder Darcy Clarke presented at the OpenJS World conference on the challenges with dependency management. In this session, Darcy Clarke presented a slide that showed how package managers yarn, pnpm, npm, bun, and deno had a significantly different number of dependencies with something as common as running the Create React App project:
The vlt project expects to tackle this and other problems with a clean look at package management.
Coupled with vlt, the team also announced vsr, a fair-source serverless package registry to provide a convenient alternative to hosting packages within an organization. The initial release of vsr focuses on a permission model allowing developers to granularly control access, such as providing read-only access to private packages. The approach is based on the Cloudflare serverless approach.
Managing dependencies remains a challenge in the JavaScript ecosystem. The vlt team is making an ambitious effort to rethink this ecosystem while providing tooling that is compatible with npm where possible.
