So libraries can be really useful,
axios was really useful,
Lodash also is really useful here.
Now still there are a couple of things you should keep in mind when working with libraries, for one
keep in mind that for example Lodash here, if you add it like this, includes a lot of functionality which
you never use.
We only use the difference method here and yet we still import all the other features as well,
that means that users of our application will download all that code even if we just use one feature.
We can see the effect if we reload our page, you see the Lodash package here has 24kb.
Now obviously that's not that big but it's way bigger than the rest of our application, so that can be
a downside, you're downloading way more than you might need and that could slow down the initial loading
time of your application which matters a lot if your application primarily targets people in areas of
the world with poor internet connection.
So that's one thing to keep in mind,
you might include a lot of overhead.
That being said however, it is worth pointing out that many libraries allow you to import them in different
ways,
for example Lodash gives you a core build which only comes with some of the features, which is way
smaller or in more advanced project setups which we'll also cover later in the course,
you even have other capabilities of basically just importing parts of a library and then stripping out
the parts which you don't need.
This project setup is not capable of doing that but we'll have a look at our project setups later in
the tooling section. So you can mitigate this problem but still, it is something to keep in mind, also
because not all libraries allow you to be as selective as I just described.
In addition to that, you also want to make sure you are working with libraries which are secure and well
maintained, let's use axios here.
It's open source which means everyone can view the source and everyone can collaborate.
Now typically when you want to work on the code and share your edited code, of course it's validated
before it's merged into this codebase, so you can't easily hack this library, instead open source typically
actually improves code quality and security because more people are looking over it and working on it.
So having open source is generally good but you want to make sure that the library you're using is also
actively maintained, so that if there are bugs, bugs that break your application or security issues which
of course also are very important, that they are fixed in time.
Now an indicator for that for example is to view the last commit,
this basically means when the code was edited the last time.
If this is two years old, then it looks like it's not actively maintained anymore,
two days, a week, a month, that is pretty active.
You can also check the releases page on Github to find out how often new versions are released and if that
is fairly regular, let's say once a year, twice a year,
then this also seems to be actively maintained,
for example axios here had its last release on June 1st at the point of time I'm recording this, which
is not too far in the past.
You can also check out the issues here and it's quite normal that every package which is popular has
a lot of issues to get an overview if
there are any big problems, though the sheer number here shouldn't be an indicator,
as I said the more popular packages, the more issues it will have, not all issues here have to be real
issues let alone big issues.
So these are some of the things you want to watch out for.
You can also judge the popularity of a package by looking at the Github stars, axios has a lot of them.
if you also have a look at some other packages, some other projects in Github, you will see that they
typically have way less stars than that.
So these are some of the things you want to consider when choosing a package,
why are these things important?
Because for one you of course don't want to add a package which might open up a security hole, that's
very important that you don't do that
and in addition even if it's not insecure, if it has bugs which are not getting fixed because it's not
maintained anymore, then your application might break and all of a sudden, the package you're depending
on is not getting updated anymore, so your application is broken and now you have to find an alternative
or write the logic which you previously used from the package on your own to make your application work
again.
So these are some considerations you should keep in mind and with all of that in mind though, there is
nothing that speaks against using third-party libraries,
they can really make your life easier and in modern development, it's normal to use typically a couple
of external libraries in every project you're working on.