3 ms·

Because they could have and should have just forked it. I wouldn't want my name being forever attributed to something I stopped working on years ago. If I make

• olliej 8y ago
  The problem is not the github repo, it’s the npm directory - specifically all those libraries that depend on libX resolve the library by that name. If you ever want to migrate ownership/maintainer of a library host through npm you have to take over the name. The alternative is changing the name (should libfoo.js become libfoo2.js? Libfoo-maintainer_name.js) etc. Then all the libraries that depend on it have to change their deps and their actual code (require(x) or import x are both based on library name). If they don’t then any libraries that transitively include the old version of the library could be compromised by any bugs that happen to be included in the old version, so you also can’t say “everyone who cares about the library should update” because library A may depend on library-B which isn’t updated. If anything the problem here is that npm doesn’t have any real “the maintainer has changed” notification, and that’s couple with the average developer not having any way to know if that change is legitimately ok without auditing the published code.
  • tracker1 8y ago
    Alternatively, they could add a freeze option that locks to the last major version, and all newer releases would be a full release version when you switch maintainers.