What they don't need is hardcoding support for five JS package managers in their python files.
In the post the maintainer says that an older version of bun "results in the ejs lockfile being ignored".
The reason is that they never committed the necessary lockfile despite listing "support" for that bun version.
They have separate lockfiles for other package manager versions: bun.lock, deno.lock, package-lock.json, pnpm-lock.yaml.
This part of the comment is also interesting: "which is a significant security concern for users when considering all of the recent npm supply chain attacks".
If you would set up a proper build for the JS artifact instead of committing four lockfiles to your repository, users would not be as exposed to npm supply chain attacks.
I speculate that I could indeed "vibe code" a better JS build integration because what they have does not make sense at a first look.
It appears they mixed JS building into their python project, aiming to support multiple package managers which are executed from their python script.
This explains the otherwise non-sensical explanation about bun < v2 ignoring the lockfile: they use a separate lockfile for each package manager. They did not check in one for bun v1, which they claimed to support, consequently it is not using a lockfile.
That's not how JS packaging normally works. I would set up a separate folder for the JS project, and use one package manager to build the project, like anyone else does.
Publish the package to npm, or bundle the tarball with your python program.
I guess the permission model of the JS runtime could be another topic, but at least they would have their build fixed without worrying about Node dependency resolution and package managers in their Python code.
I often hear people talk online about burning data centers to avoid some capitalist dystopia.
It just seems incredibly pessimistic to me. Who wants civil unrest? The rich elite does not want this either.
We will pay people.
Capitalism is not set in stone when human labor is no longer essential for productivity and AI can handle planning that markets currently coordinate through capitalism.
But I don't think I'm going to email the mods and beg them to remove me from some list they added me to without notifying me.
I don’t feel like apologizing for complaining about the drivel some write because they don't like LLMs.
It was not my most substantial or productive comment, but I feel it is fair enough and did not target anyone in particular.
Contributing to HN is not worth it.
I'm spending my time, compromising my privacy, and advising potential competitors on what works best in my workflow. It's often not appreciated, so I might as well stop commenting so much.
I am working like 20 hours a week on my new iOS app with Codex.
People on here talk like it was some belief or suggest I am somehow profiting from "hyping" AI.
Is it so hard to believe that agentic coding now works? Engineers are taking it up left and right.
Edit with reply: I can't, because the app is still in the works. Also my HN account is again rate limited and I won't be able to post more comments.
Edit number two to the other comment:
It's not really that expensive. With Anthropic it would be $200, with Codex the $100 subscription is sufficient.
It is interesting phrasing when you say that the providers "are making me think" the use of their service would be better, rather than me reaching this conclusion myself after using their services extensively for my work.
And honestly, I think I've had it with HN. I can't even participate properly in the discussion, maybe because some moderator thought my comments and opinions unworthy again.
Before Codex with GPT 5.4 and 5.5 I was working on a single feature only, no parallel conversations, and a ton of permission prompts would make it impossible for the agent to even work for five minutes on its own.
With GPT 5.4 or 5.5 I did not notice degradation in performance when it was working on a large 5k line file containing a WebView, JS scripts, as well as native UI.
I instructed it to split it up anyway, yet I wonder how often the concerns around the mess are imaginative rather than practical.
Microservices in big companies where you have to first write the spec and then fully understand the changes is maybe among the least benefiting use cases yet.
When you work on just a new mobile app, this is where I find AI is making the biggest difference.
On mobile you don't need specs and you don't need to understand every detail of the implementation. You can QA test the app on a real device. It gives me more confidence than just having written the code myself, and it's much faster. You can implement multiple major features in a single day.
This kind of e2e testing is just not possible with backend services.
While this arXiv policy seems reasonable enough, I don't care for the kind of drivel some post on HN because they don't like LLMs.
I'm here because I enjoy building things. And today this mostly happens with AI. I could do without the often thoughtless comments and conspiracy theories about "LLM hypers" posted by people who don't like LLMs.
In the post the maintainer says that an older version of bun "results in the ejs lockfile being ignored".
The reason is that they never committed the necessary lockfile despite listing "support" for that bun version.
They have separate lockfiles for other package manager versions: bun.lock, deno.lock, package-lock.json, pnpm-lock.yaml.
This part of the comment is also interesting: "which is a significant security concern for users when considering all of the recent npm supply chain attacks".
If you would set up a proper build for the JS artifact instead of committing four lockfiles to your repository, users would not be as exposed to npm supply chain attacks.