5 ms·
The NPM fiasco should no longer be possible If you want to unpublish a package after 72 hours have passed, contact npm Support. For more information about why
by byte1918 7y ago
The NPM fiasco should no longer be possible
If you want to unpublish a package after 72 hours have passed, contact npm Support. For more information about why we don’t allow users to unpublish packages after 72 hours, see our unpublish policy.
https://docs.npmjs.com/unpublishing-packages-from-the-registry https://docs.npmjs.com/unpublishing-packages-from-the-regist...
- celticninja 7y agoCould you just publish garbage instead?
- yoz-y 7y agoYou could but everybody uses version pinning in production, right?
- emsy 7y agoPeople who are serious about reproducible builds host their own repos. Most people probably don’t know the difference between ^1.0.1 and ~1.0.1
- bakuninsbart 7y agoThanks for making me look that up!
- delfinom 7y agoIf only npm's version pinning actually version pinned without idiotic subrules. package-lock.json is just one massive lie.
- minitech 7y agoWhat do you mean?
- jpangs88 7y agoVersioned garbage, but yeah you could. It would just make a new version not work which isn't as harmful as taking away a package.
- leppr 7y agoIt was never possible without "admin" intervention. That whole inccident was NPM's sole responsibility.
- Crinus 7y agoNot sure how npm works in detail, doesn't it pull directly from devs' repositories? In that case can't the devs just publish an update that breaks everything?
- julianwachholz 7y agoThis wouldn't be as big of a problem with version pinning.
- parsimo2010 7y agonpm allows for installation of specific versions. So even if a dev publishes a new version that breaks you can select a previous version known to work. A good dev shouldn’t be updating willy-nilly to the latest version just because it’s the latest. They ought to spec a particular version and update after testing.
- monocasa 7y agoDoesn't npm allow a dev to replace or redact already released versions?
- precisioncoder 7y agoDoesn't the code still technically belong to you? Can't you submit a takedown request?
- jrockway 7y agoIt belongs to you but you distributed it with a license that gives away some of your rights.