3 ms·
...and then the publisher pulls their library off npm, and another shows up and drops one of the same name in its place, with compatible version numbers (by hap
by white-flame 11y ago
...and then the publisher pulls their library off npm, and another shows up and drops one of the same name in its place, with compatible version numbers (by happenstance or otherwise).
- morgante 11y agoA version can't be republished.
- michaelmior 11y agoTrue, but it's common to have requirements of the form "^1.0.0" (especially since this is the default of npm i --save). It's easy to publish a new version that would be installed by a project declaring a dependency in this form.
- morgante 11y agoYes, but it's trivial to pin your dependencies exactly. That's not a reason to avoid small modules.
- sghodas 11y agoThat's exactly the problem the parent comment suggests we focus on fixing. Once a library is published, npm shouldn't allow anyone to use that name even if the library is pulled.