@hongminhee洪 民憙 (Hong Minhee) im not sure if i agree with the main context of the post, I do understand the reasoning behind it, but using a library is just moving this to a third party, making a target for chain attacks…
@shinspiegelJeferson 'Shin' That's a fair concern in general, but it applies to any dependency, not just CLI parsers. Optique's core package has zero runtime dependencies, which keeps the attack surface minimal. If supply chain security is a priority, you could also vendor the code or pin to specific versions. That said, manually parsing process.argv for anything beyond trivial cases tends to introduce its own bugs.
If you have a fediverse account, you can reply to this note from your own instance. Search https://hackers.pub/ap/notes/019b92a8-764c-7b4e-99e2-686119accc34 on your instance and reply to it.
@hongminhee洪 民憙 (Hong Minhee) Good point. But if I may ask, how often do your CLI tools and utilities require more than 2~5 arguments? In my professional (and personal) work, I think I encountered a couple of cases, which we broke down into two/three different utilities and used the stdin/stdout with good piping.