Dub has two big problems.

1. Unmaintained dub stuff.
2. Let's say you need bindings to postgresql library and you will see dub pulling in numerous of libraries, which have nothing at all to do with postgresql.
   More like a framework stuff. This creates unneeded complexity, bloatware, dependency hell, maintainability, in my humble opinion. Dub should do one thing and do it good.
   Feel free to elaborate.

Is there a security review for dub packages ?

On Sunday, 1 August 2021 at 15:38:32 UTC, Alain De Vos wrote:

Wait, you don't use isOdd package in your frontend? No way...

(also for that "bloat" part, this is where the linker comes in and strips it all, unless you are talking about accidentally added dependencies on "just in case" basis which is a sign of design issues)

On Sunday, 1 August 2021 at 15:38:32 UTC, Alain De Vos wrote:

It seems to me like these are not really problems with the dub package manager or the dub archive itself, but with the quality of individual packages.

There is a community-maintained list of high-quality D resources (including dub packages) available on github:

https://github.com/dlang-community/awesome-d

Ideally, something like this would be integrated into code.dlang.org itself, so that users could see at a glance which packages are considered high-quality by the D community.

A simple and small wrapper around for instance the C-library libpq should be part of the language itself and should not pull in more than libpq itself.

A simple example, dub package dpq2 pulls in,
money,vide-d,stdx-allocator,derelict-pq,derelict-util
This all for a handfull of C-functions.

On Sunday, 1 August 2021 at 17:18:39 UTC, Alain De Vos wrote:

I don't disagree. The question is, who will volunteer to create and maintain this wrapper?

On Sunday, 1 August 2021 at 17:25:26 UTC, Alain De Vos wrote:

let's see

Money - fits pretty ok, cause your average SQL has decimal type for that purpose but there is no built-in one in D

vibe-d - probably because it handles DB connection and/or keep things async way, sure you probably can do it with Phobos but it will be much more PITA and less performant

stdx-allocator - memory management, and it is also possible to reduce GC pauses it is probably uses malloc'ed buffers

derelict-pg - C API wrapper for PostgreSQL

derelict-util - handles function pointers loading for that wrapper

That's it. Why do you think this is bloat? You know, D coders are very careful when it comes to using dependencies, it's not like in JS where shit got imported just because it exists, so I don't get your complains on that.