Development dependencies considered harmful

Time is a precious resource for open source maintainers, especially if you aren’t doing it as part of paid work. The constant churn of changing development tools steals a huge chunk of that time. For example, I’m running NoFlo on a daily basis, but do changes to the library itself quite rarely. There were nearly six years between releases recently. The other day I wanted to add some functionality, and ran immediately to a huge set of issues with the development tooling we use. Basically everything we rely on is deprecated and has a huge set of security issues. Just to show some: Karma, which we use to run browser tests is deprecated since 2023 eslint has made a huge backwards incompatible release, and the AirBnB rules we use haven’t been carried over On top of these our test runner, the assertion library, coverage checker, etc all have major releases out. Not upgrading means having a growing list of security warnings on every install. At worse they may affect the security of your…