Barrel Files in TypeScript Can Double Bundle Size, Developers Warn

·2 views

Barrel files — index.ts files that re-export multiple modules from a folder — are a widely taught clean-code practice that can silently break tree-shaking and inflate JavaScript bundles. A 2024 test by Bartosz Łaniewski found that importing a Material-UI component via a barrel file produced a 151 kB bundle, compared to just 75 kB with a direct import. React Query's team reported a 68% reduction in loaded modules after removing internal barrel files from their Next.js project, cutting startup times from 5–10 seconds to around 3.5k modules. Vite's official documentation now explicitly warns against barrel files under its performance tuning section, and Next.js 13.5 shipped a dedicated compiler option, optimizePackageImports, to mitigate the problem with third-party packages. Developers are increasingly recommending direct source imports for performance-sensitive code rather than relying on barrel file conventions.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Auditing 129 Browser Games Reveals HTTP 200 Does Not Mean a Game Is Playable

A developer auditing 129 catalog entries on G4G.IO found that all routes returned HTTP 200, yet that metric alone could not confirm whether games were actually playable. The audit, conducted on August 19, 2026, revealed that a game can display a polished launch screen while remaining entirely unresponsive to clicks, keyboard input, or touch controls. The developer identified three distinct health layers — page health, source health, and gameplay health — arguing that passing the first two does not guarantee the third. Key failure modes included play buttons obscured by overlaid elements, cross-origin focus blocking keyboard input, and providers silently redirecting embeds to promotional pages. The key recommendation is that acceptance testing must include at least one verified input-driven screen change after the loading screen, on both desktop and mobile devices.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Zero Trust Architecture Cuts Average Data Breach Costs by $1.76 Million, Data Shows

Organizations that implement Zero Trust security architecture save an average of $1.76 million per data breach compared to those without it, according to annual breach-cost research based on real incidents. The global average cost of a data breach currently stands at $4.44 million, rising to $10.22 million in the United States, making security investment decisions increasingly data-driven. Mature Zero Trust deployments are associated with breach costs of around $4.15 million, versus $5.10 million at organizations lacking such architecture. The savings stem largely from Zero Trust's ability to limit lateral movement after an initial compromise, reducing the average 241-day breach lifecycle. Other top cost-reducing controls include a tested incident response plan, which saves $2.66 million on average, and extensive AI-driven security automation, which saves approximately $1.9 million per incident.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How a Stateless AgentCore Runtime Led to a Smarter MCP Write Design

A team building an MCP server on Amazon Bedrock AgentCore Runtime for AWS Marketplace seller operations encountered a key architectural constraint: the runtime is fully stateless with per-session microVM isolation, making it impossible to store pending operations between calls. Rather than adding a database to temporarily hold unconfirmed changes, the team devised a deterministic token system that hashes the change set alongside the entity version, eliminating the need for any server-side state. This approach automatically invalidates tokens if the change set is edited after preview or if the underlying product data shifts before submission, enforcing human review without persistent storage. The developers noted that AgentCore Runtime functions essentially as container hosting with an MCP-shaped contract and does not include a built-in model. They also flagged unexpected cost patterns, warning that CloudWatch logging expenses can exceed compute costs if left unconfigured.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Key Metrics That Reveal Whether Your CI/CD Pipeline Is Truly Secure

CI/CD pipelines now handle critical tasks like software builds, infrastructure provisioning, and production deployments, making them a major attack surface for organizations. Security health cannot be gauged simply by confirming that scanners are enabled; meaningful metrics must show whether controls are consistently applied and vulnerabilities are genuinely resolved. Core indicators include vulnerability discovery rates tracked by severity and trend, the percentage of critical flaws reaching production, and Mean Time to Remediate broken down by severity level. Security scan coverage — measuring how many repositories and production-bound pipelines have controls like SAST, secret detection, and container scanning — is equally essential. Together, these metrics shift pipeline security from a checkbox exercise to a measurable, risk-reduction discipline.

0 comments Read more at DEV Community