5 ms·

yeah - thinking it'd be helpful for npm to have a diff command to check source changes when doing upgrades.

• btown 8y ago
  Unfortunately, this is made difficult to "bootstrap" due to npm not supporting/promoting repeatable builds - so you'd just see a diff of minified messes with no ability to track back to source code changes. You'd want to do this alongside a rollout of a larger ecosystem around cryptographically secure repeatable build tracking, which would take time and require "drag-along" of the entire ecosystem of abandoned packages.
  • mifreewil 8y ago
    Very few packages actually contain minified sources - it's not really needed with modern build tools. I think it was an exception in this case, and that by itself could be suspicious. Current version of npm now contains a package-lock.json file which is made to make builds pretty close to deterministic. It contains the entire dependency tree of dependency names, versions, and hashes. I say pretty close because it's still possible to break "npm install" by unpublishing a package.