DEV Community

ke jia
ke jia

Posted on

Template Rot: Your Starter Broke Somewhere Between Node 18 and 22

#webdev #javascript #typescript #cli

I cloned a "production-ready React starter" from a popular repo last month. It was two years old. The first npm install worked. The second command — npm run dev — did not.

The cascade:

  • Vite 4 config syntax that Vite 6 no longer accepted
  • React 18 createRoot in a file that also imported a removed react-dom helper
  • An ESLint flat-config migration half done: the repo had both .eslintrc.js and eslint.config.js, and the new one was commented out
  • typescript@5.0 pinned while the code used satisfies correctly but tsconfig still had noImplicitAny: false
  • 47 vulnerabilities from transitive deps, three of them in the build pipeline itself

The starter wasn't malicious. It wasn't even bad when written. It had simply rotted: every version it pinned was a photograph of an ecosystem that moved on.

Starters are time machines

This is the property nobody warns you about. A template pins a universe the moment it's committed:

your-starter/
  package.json   <- versions frozen at authoring time
  tsconfig.json  <- compiler behavior frozen
  vite.config.ts <- plugin API surface frozen
  .eslintrc.js   <- rule set frozen (and maybe already obsolete)
Enter fullscreen mode Exit fullscreen mode

Six months later, the universe has moved. The starter still starts — until it doesn't, which is usually on day one, during setup, when you have zero context for why the error exists.

I've started rating starters on one axis: does it still compile, on a clean machine, today? Not "was it good in 2024." Today.

What I actually check before using any template

  1. The scaffolder's own dependency count. If the template generator has 40 dependencies, the generator itself is the supply-chain attack surface. I want the generator to be boring: pure Node, ideally one file.
  2. "Every template compiles" as a claim you can test. Not a screenshot. A CI job that runs the generated output. If a project doesn't prove its output builds, it's marketing.
  3. TypeScript strict mode in the generated tsconfig, not as an opt-in. The first week of a project is when type discipline gets set; a starter that defaults to strict: false is teaching your team the wrong lesson.
  4. .gitignore that already excludes .env and ships .env.example. Half the "oops, committed our secrets" incidents are the starter's fault, not the developer's.

The one I've been using since

I ended up standardizing my team on scaffoldx-cli. Not because it's the only option, but because it ticks the boxes above and I can verify them myself:

  • Zero dependencies. The generator is a single Node file. There is no transitive supply chain to audit.
  • 12 templates, each verified to compile: React + Vite, Next.js, Express API, FastAPI, Chrome Extension (Manifest V3), CLI tool, Landing Page, Discord bot, Electron, Python script, Vanilla HTML/CSS, and a strict-mode empty TypeScript project.
  • 3 seconds from npx to a git-initialized project with ESLint, Prettier, and strict tsconfig already in place. 
$ npx scaffoldx-cli
? Choose a template  React + Vite
? Project name      my-app
? Done. cd my-app && npm install
Enter fullscreen mode Exit fullscreen mode

The templates pin a known-good set of versions — that's the whole point of a starter — and the maintenance burden is visible: when a new Vite breaks the React template, the next release of the CLI is the fix, and you get it with the next npx.

Rot is inevitable. The question is who sweeps.

Every starter will rot; that's physics. The difference is whether the rot is swept by a maintainer who tests the generated output, or discovered by you, at 11pm, on a clean machine, with no context.

Before you clone a template for a real project, run it on a throwaway machine. If day-one setup needs archaeology, the starter is already dead — you just haven't found the body yet.

$ npx scaffoldx-cli
Enter fullscreen mode Exit fullscreen mode

More Tools

Tool What it does Command
scaffoldx-cli 12 production-ready project templates in 3 seconds npx scaffoldx-cli
dotguard Scan .env files for exposed secrets npx @wuchunjie/dotguard
gitpulse Git repo analytics in your terminal npx @wuchunjie/gitpulse
snippetx Terminal code snippet manager npx @wuchunjie/snippetx

If these save you time, consider buying me a coffee. All tools are MIT-licensed, zero-dependency, and run fully offline.

Top comments (0)