4 ms·
NPM restricts the developer from being able to push to the same version of a package twice.
by munro 11y ago
NPM restricts the developer from being able to push to the same version of a package twice.
- 33a 11y agoUnless you unpublish then republish over it.
- swang 11y agoThis was possible before but no longer true. A version X will either return the original version X or a does not exist (if you unpublish)
- stordoff 11y agoIf you explicitly requesting a particular version, that mitigates the security concerns to some degree (though as this incident proves, you are still reliant on that version being published for proper functionality). That said, the fact that npm's blog [0] indicates that a republished package (with a new version number) mitigated the issue to some degree, and this comment [1] suggesting that the default behaviour is to get the latest minor release, makes me wonder how widespread of a practice that is in reality. [0] http://blog.npmjs.org/post/141577284765/kik-left-pad-and-npm http://blog.npmjs.org/post/141577284765/kik-left-pad-and-npm [1] http://www.haneycodes.net/npm-left-pad-have-we-forgotten-how-to-program/#comment-127246 http://www.haneycodes.net/npm-left-pad-have-we-forgotten-how...