A Preliminary Study on Self-Contained Libraries in the NPM Ecosystem

TL;DR

This paper analyzes self-contained libraries in the NPM ecosystem by examining dependency histories of 2,763 libraries. It introduces two categories—Always Self-Contained and Become Self-Contained—and finds that 39.49% are self-contained, with 40.42% of them achieving this status through prior dependency removal, notably involving babel-runtime. The empirical study identifies top removed dependencies (e.g., babel-runtime, get-stdin, minimist) and reveals that many removals relate to sub-dependencies within bundled packages like lodash. Reasons driving removals are dominated by dependency performance and minimization, with implications for reducing fragility and improving install efficiency. The work suggests tooling to guide dependency pruning and highlights practical strategies for developers to manage dependencies more effectively across ecosystems.

Abstract

The widespread of libraries within modern software ecosystems creates complex networks of dependencies. These dependencies are fragile to breakage, outdated, or redundancy, potentially leading to cascading issues in dependent libraries. One mitigation strategy involves reducing dependencies; libraries with zero dependencies become to self-contained. This paper explores the characteristics of self-contained libraries within the NPM ecosystem. Analyzing a dataset of 2763 NPM libraries, we found that 39.49\% are self-contained. Of these self-contained libraries, 40.42\% previously had dependencies that were later removed. This analysis revealed a significant trend of dependency reduction within the NPM ecosystem. The most frequently removed dependency was babel-runtime. Our investigation indicates that the primary reasons for dependency removal are concerns about the performance and the size of the dependency. Our findings illuminate the nature of self-contained libraries and their origins, offering valuable insights to guide software development practices.

Figures (5)

• Figure 1: Overview of library selection
• Figure 2: Overview of gathering target commits
• Figure 3: The most reduced dependencies
• Figure 4: The most reduced dependencies without lodash bundled dependency
• Figure 5: The most reduced dependencies only lodash bundled dependency