Description
I've seen a few questions, issues, PR for review on vetting which external libraries to bring in? Not sure if this is the best place, but wanted to share what I generally look for when adding new dependencies while it is on my mind. I can check these out for you, esp if you post a list of all the ones you may be considering :)
There's no need to write all of our software from scratch, but we also want to balance convenience with the control we'll have over the maintainability of our software when we add external components
Things I look for:
- The Docs does it have readable documentation? feel free to link to the docs of new dependencies in the pull request adding them, others can scope it out and see if they have questions and if they would easily know how to use this
- Their Release Process does the repository have clear release and patch communication? Does it seem brittle or upredictable? ie will the dependency change underneath us without warning? Do you see a lot of "rollbacks?" If so, make sure to use appropriate syntax to pin it to a specific version dependency management file to minimize that risk. (if you add a dependency, see if you can help take stewardship over the dependabot PR's on that resource in the future, too!)
- Contributor Community Health does the repo have a good # of contributors? are open issues getting comments and resolutions? There's no right number, just check it out for red flags (i.e. 2 contributors that haven't responded in over a year might not be a reliable choice)
- The License make sure there's clear permission to use the software in the way we intend.
Bonus:
- Do they seem performant? are they bundled and loaded (or can they be bundled and loaded) in a way that doesn't significantly slow our system? If there's only one or two functions or features we need, see if they've provided a way to custom load just those. (this differs a lot across languages and libraries and may not be possible)
- Are there documented security issues? I'm not the best at security, any one got tips on this??
A thing I've done on teams before is created a pull request of the bare minimum code to add the dependency to a project and briefly listed the features I found useful from the library and how I might be using them. That way our asynchronous team had a place for discussion and group "vetting" of a library - each with different concerns (devops, security, performance, complexity etc). Dunno if that works here, but sharing what I know :)
What do y'all think? What do you look for??