chore: replace @ungap/from-entries with own helper

[netlify-team-account-1]

- Summary

In the spirit of #3445, I took a look at our package.json to identify other modules we could likely bring into the repository to reduce installation time (which correlates more with number of packages, that with their individual size). @ungap/from-entries is one of them: It's a polyfill for Object.fromEntries, meaning a naive version can easily be rebuilt oneself. This PR introduces a naive replacement.
Bringing it into the repository, however, brings a bigger maintance burden (writing tests, catching edge cases).

It's a good thing that there are specialised packages for this - but since npm install doesn't scale well with number of packages installed, it has a negative impact on CLI's install time.

In order to bring down install time, we could think about bundling together oft-used modules in a netlify/utils package. Other candidates for that would be @sindresorhus/slugify and is-plain-obj, both of which are used across CLI, Build, and Config. By bundling these dependencies at build-time of netlify/utils (aka: shipping them as part of the own dist files, don#t include them in dependencies), we could bring down number of packages installed somewhat.

OTOH, Netlify-controlled dependencies are most likely a drop in the sea, as long as packages that we don't want to bundle bring in these helper packages. So we likely won't see a noteworthy improvement from introducing netlify/utils.

(this PR is not meant to be merged, but as an argument to the read-pkg-up debate)

- Test plan

- A picture of a cute animal (not mandatory but encouraged)

[github-actions]

📊 Benchmark results

Comparing with 6d6022e

Package size: 353 MB

(no change)

^  352 MB  352 MB  352 MB  352 MB  352 MB  352 MB  352 MB  352 MB  352 MB  352 MB  352 MB  352 MB  353 MB 
│   ┌──┐    ┌──┐    ┌──┐    ┌──┐    ┌──┐    ┌──┐    ┌──┐    ┌──┐    ┌──┐    ┌──┐    ┌──┐    ┌──┐    ┌──┐  
│   |  |    |  |    |  |    |  |    |  |    |  |    |  |    |  |    |  |    |  |    |  |    |  |    |▒▒|  
│   |  |    |  |    |  |    |  |    |  |    |  |    |  |    |  |    |  |    |  |    |  |    |  |    |▒▒|  
│   |  |    |  |    |  |    |  |    |  |    |  |    |  |    |  |    |  |    |  |    |  |    |  |    |▒▒|  
│   |  |    |  |    |  |    |  |    |  |    |  |    |  |    |  |    |  |    |  |    |  |    |  |    |▒▒|  
│   |  |    |  |    |  |    |  |    |  |    |  |    |  |    |  |    |  |    |  |    |  |    |  |    |▒▒|  
│   |  |    |  |    |  |    |  |    |  |    |  |    |  |    |  |    |  |    |  |    |  |    |  |    |▒▒|  
│   |  |    |  |    |  |    |  |    |  |    |  |    |  |    |  |    |  |    |  |    |  |    |  |    |▒▒|  
│   |  |    |  |    |  |    |  |    |  |    |  |    |  |    |  |    |  |    |  |    |  |    |  |    |▒▒|  
│   |  |    |  |    |  |    |  |    |  |    |  |    |  |    |  |    |  |    |  |    |  |    |  |    |▒▒|  
│   |  |    |  |    |  |    |  |    |  |    |  |    |  |    |  |    |  |    |  |    |  |    |  |    |▒▒|  
│   |  |    |  |    |  |    |  |    |  |    |  |    |  |    |  |    |  |    |  |    |  |    |  |    |▒▒|  
│   |  |    |  |    |  |    |  |    |  |    |  |    |  |    |  |    |  |    |  |    |  |    |  |    |▒▒|  
│   |  |    |  |    |  |    |  |    |  |    |  |    |  |    |  |    |  |    |  |    |  |    |  |    |▒▒|  
│   |  |    |  |    |  |    |  |    |  |    |  |    |  |    |  |    |  |    |  |    |  |    |  |    |▒▒|  
│   |  |    |  |    |  |    |  |    |  |    |  |    |  |    |  |    |  |    |  |    |  |    |  |    |▒▒|  
│   |  |    |  |    |  |    |  |    |  |    |  |    |  |    |  |    |  |    |  |    |  |    |  |    |▒▒|  
│   |  |    |  |    |  |    |  |    |  |    |  |    |  |    |  |    |  |    |  |    |  |    |  |    |▒▒|  
│   |  |    |  |    |  |    |  |    |  |    |  |    |  |    |  |    |  |    |  |    |  |    |  |    |▒▒|  
│   |  |    |  |    |  |    |  |    |  |    |  |    |  |    |  |    |  |    |  |    |  |    |  |    |▒▒|  
│   |  |    |  |    |  |    |  |    |  |    |  |    |  |    |  |    |  |    |  |    |  |    |  |    |▒▒|  
└───┴──┴────┴──┴────┴──┴────┴──┴────┴──┴────┴──┴────┴──┴────┴──┴────┴──┴────┴──┴────┴──┴────┴──┴────┴──┴──>
    T-12    T-11    T-10    T-9     T-8     T-7     T-6     T-5     T-4     T-3     T-2     T-1      T    

Legend

• T-30 (6d6022e): 353 MB
• T-29 (532a040): 353 MB
• T-28 (82bd008): 353 MB
• T-27 (8192dba): 353 MB
• T-26 (95890b2): 353 MB
• T-25 (0208c89): 353 MB
• T-24 (7815bbb): 352 MB
• T-23 (68fd362): 352 MB
• T-22 (b6446af): 352 MB
• T-21 (3e3c80a): 352 MB
• T-20 (adae111): 352 MB
• T-19 (76a9aa6): 352 MB
• T-18 (e406f33): 352 MB
• T-17 (4289e60): 352 MB
• T-16 (1ebb1e7): 352 MB
• T-15 (414bd99): 352 MB
• T-14 (0ae6e5a): 352 MB
• T-13 (2e1a50c): 352 MB
• T-12 (a1cb1ab): 352 MB
• T-11 (db1fd6c): 352 MB
• T-10 (ebbe72a): 352 MB
• T-9 (9cddb74): 352 MB
• T-8 (33a6660): 352 MB
• T-7 (efd1e20): 352 MB
• T-6 (284cfe4): 352 MB
• T-5 (4eff385): 352 MB
• T-4 (24441dd): 352 MB
• T-3 (1ec1b66): 352 MB
• T-2 (db89b4d): 352 MB
• T-1 (9e8bb0a): 352 MB
• T (current commit): 353 MB

[ehmicky]

I am not convinced using our own small modules instead of re-using others would be an improvement, for several reasons:

• This might not always reduce our package's size, due to deduping. It might actually be the opposite. Especially for sindresorhus' packages, which are most likely used by our other dependencies.
• Bundling/vendoring might end up increasing the package's size, since different modules would not be able to share code. For example, netlify-cli uses @netlify/build which itself uses @netlify/zip-it-and-ship-it, but they all use some common utilities. Those should be in node_modules so they can be deduped.
• Even small modules come with lots of niceties which we would need to maintain otherwise, especially automated tests and handling of specific edge cases. It is not uncommon to hit production bugs due to subtle issues in utilities.
• Others' small modules are already typed with TypeScript, for many of them, which will help us transition to TypeScript.
• The same applies to security: widely used small Node modules are triggering security notices (through GitHub, npm audit, etc.) when a vulnerability is found, while this would not apply if we had our own utilities.

Small installation size is good, but we should also consider maintenance cost, security and stability, which are more important IMHO

Overall, I don't think this would be an improvement and might distract us from other engineering initiatives. The installation size of netlify-cli is a problem, but we might want to address it by starting with removing big Node modules instead.

cc @erezrokah @eduardoboucas @JGAntunes What do you all think?

[erezrokah]

cc @erezrokah @eduardoboucas @JGAntunes What do you all think?

I agree with @ehmicky. There's no data the suggested approach helps with installation size.
This PR specifically doesn't:
#3491 (comment)

Closing the PR. We can further discuss in an issue if we chose to.