Package managers such as NPM have become essential for software development. The NPM repository hosts over 2 million packages and serves over 43 billion downloads every week. Unfortunately, the NPM dependency solver has several shortcomings. 1) NPM is greedy and often fails to install the newest versions of dependencies; 2) NPM's algorithm leads to duplicated dependencies and bloated code, which is particularly bad for web applications that need to minimize code size; 3) NPM's vulnerability fixing algorithm is also greedy, and can even introduce new vulnerabilities; and 4) NPM's ability to duplicate dependencies can break stateful frameworks and requires a lot of care to workaround. Although existing tools try to address these problems they are either brittle, rely on post hoc changes to the dependency tree, do not guarantee optimality, or are not composable. We present PacSolve, a unifying framework and implementation for dependency solving which allows for customizable constraints and optimization goals. We use PacSolve to build MaxNPM, a complete, drop-in replacement for NPM, which empowers developers to combine multiple objectives when installing dependencies. We evaluate MaxNPM with a large sample of packages from the NPM ecosystem and show that it can: 1) reduce more vulnerabilities in dependencies than NPM's auditing tool in 33% of cases; 2) chooses newer dependencies than NPM in 14% of cases; and 3) chooses fewer dependencies than NPM in 21% of cases. All our code and data is open and available.

翻译：包管理器如NPM已成为软件开发不可或缺的工具。NPM仓库托管超过200万个包，每周服务超过430亿次下载。然而，NPM的依赖解析器存在若干缺陷：1) NPM采用贪心算法，常无法安装依赖项的最新版本；2) NPM算法导致依赖重复和代码臃肿，这对需要最小化代码体积的Web应用尤为不利；3) NPM的漏洞修复算法同样具有贪心特性，甚至可能引入新漏洞；4) NPM的依赖复制能力可能破坏有状态框架，需要大量人工规避。尽管现有工具试图解决这些问题，但存在脆弱性、依赖事后调整依赖树、无法保证最优性或不具备可组合性等局限。本文提出PacSolve——一个支持可定制约束与优化目标的依赖解析统一框架及其实现。我们利用PacSolve构建了MaxNPM，作为NPM的完整即插即用替代方案，使开发者能在安装依赖时组合多个优化目标。通过对NPM生态中大量样本包的评估，实验表明MaxNPM能够：1) 在33%的案例中比NPM审计工具减少更多依赖漏洞；2) 在14%的案例中选择比NPM更新的依赖版本；3) 在21%的案例中比NPM选择更少的依赖。所有代码与数据均已开源。