Replace various packages with faster, smaller alternatives

[beeequeue]

Hi, would you be open to a PR that replaces some of the libraries used in this package with faster, smaller alternatives?

The ones I have my eyes on are:

• ansi-styles -> ansis
  • faster
  • 17kb -> 6kb
• read-package-json-fast -> empathic + JSON.parse(readFileSync)
  • allows for finding manifests above the exact current working directory
  • the package doesn't really use any features from read-package-json-fast except opening+parsing the file
  • 22kb -> 18kb
• minimatch -> picomatch
  • faster
  • 446kb -> 83kb
• cross-spawn -> tinyexec / nano-spawn
  • would require upping minimum node version to >=20.19
  • more modern
  • 35kb -> 27kb

[bcomnes]

I’ll re-review them and see if I want to switch over if it makes sense.

[voxpelli]

Colors are built into node.js core since v20.12.0: https://nodejs.org/api/util.html#utilstyletextformat-text-options

[voxpelli]

Regarding picomatch I agree, and when we bump lowest supported version of Node.js to 22, then we can use the built in globbing hopefully: #146 (comment)

[beeequeue]

Colors are built into node.js core since v20.12.0

Yes but sadly the API design is quite a bit worse than the current color packages, while also being slower and less tested by the community. 🙁

ansis has a great readme comparing all the different alternatives and showing pros and cons:
https://github.com/webdiscus/ansis#-why-use-ansis

[bcomnes]

@beeequeue Looks like the picomatch swap is causing issues:

• run-s crashes when upgrading to v8 #173
• [BUG] picomatch globstar is more aggresive, causes a breaking change #174

Any suggestions on how to fix those? If not, we'll probably have to roll that specific change back until we do.

[bcomnes]

Seems related to the use of ** globs.

[beeequeue]

From my quick testing it seems very inconsistent across libraries

e.g. picomatch and micromatch returning differently despite being maintained by the same people

[beeequeue]

I think the problem is that the setting strictSlashes should be enabled, then it should work as before.

[bcomnes]

I requested those that ran into issues to re-test on 8.0.4-beta.0.

[jdalton]

Curious Q here. Why does file size matter for this non-client side package? This PR saves a total of say 386kb raw, so like 0.15s on 4G LTE. However, packages are downloaded as tarballs so compressed (.tgz) more and then cached locally through pnpm/npm/github-actions etc. Here the cost, compatibility issues and inconsistencies, doesn't seem to be worth the reward on a dev local kind of thing.

[bcomnes]

Got confirmation 8.0.4-beta.0 is working for downstream users who had issues. Since we already paid the cost on this one mostly, I'll give it one more go but if we run into more issues with it, I think we're rapidly entering a cost/value tradeoff that isn't worth it.

I would very much rather spend maintenance time on this project on higher value issues like getting type checking set up, modernizing the codebase or speeding up the test suite vs dependency swaps of increasingly little value over the ones we've already landed.

[bcomnes]

Not totally unrelated: #181