[RRFC] Expose dependents API

[ruyadorno]

There are some discussion happening over at the package-maintenance WG surfacing the need from maintainers to have a better programmatic access to registry info on what modules are depending on a given module.

See:

• discussion with NPM on depenedent module statistics nodejs/package-maintenance#331
• Dependents tooling nodejs/package-maintenance#327

[ljharb]

This would also include dev deps, and optional deps, and peer deps - none of which are currently surfaced on the website (but all of which should be!)

[ghinks]

It is often useful in discussions like this to start with the question of why this is needed. The question of why has come about due to the long term evolution of the registry and the myriad of interdependent modules within it. From a maintainers/contributors perspective it is now essential to be able to find out who is using a module. For widely used modules it will become more and more important to give the most highly downloaded dependents either a heads up of forthcoming changes or to allow a maintainer to test the dependents.

Now that I have discussed the why we should discuss the how and what. This is what do we want and how best to deliver it.

From what @ljharb and @andrewhughes101 have discussed previously it looks like we need an API.

The API would allow dependent modules to be queried. @ljharb has
correctly added that

• dependent
• dev dependent
• peer dependent
• optional dependent

modules should be made available via the API. For instance for module X what are the dev dependencies that depend upon it.

The question of how is equally important. Any API would have to access some sort of DB. The frequency of the DB updates would in many cases not be critical ( frequency of update, I think feedback here would help). However what would be really useful is if the API could allow queries by dependent download count and maybe provide some sort trigger which could allow notification that a dependent is now widely used ( has many downloads ) and that the module's maintainer that is being depended upon may now be interested in. I am thinking that the registry may not want this API scanned too frequently.