Single-file scripts autoinstall dependencies support

[jcrben]

Bun and deno allow for writing imports in single-file scripts without a package.json - in bun I believe this is called auto-install or autoimport with the Bun module resolution algorithm https://bun.sh/docs/runtime/autoimport

This aligns with similar features in various languages https://dbohdan.com/scripts-with-dependencies#javascript - @Grab from Groovy is a relatively old flavor of this feature, with Python's pip-run being more recent

I tried to find an issue proposing this feature but I couldn't - has this been discussed? I figured searching bun or deno would be mentioned in such an issue and I didn't find them.

[avivkeller]

CC relevant teams: @nodejs/loaders @nodejs/npm

[mcollina]

I'm sorry, but the explanation of "why not" is likely pretty long, and I have no real time for it. It boils down to security and reproducibility, so I don't expect this feature to be implemented anytime soon.

[avivkeller]

Additionally, it requires Node.js/npm to have an on-the-fly caching system, which isn't an easy feat to implement...

[jcrben]

Appreciate the response and understood. In terms of reproducibility, bun allows for specifying a version: https://bun.sh/docs/runtime/autoimport#version-specifier (other languages work similarly such as pip-run and @Grab). For security, people can point to a private registry and manage what is in that private registry. But granted not sure how much this might mess with standards in the language.