9 ms·

Why would the registry do anything at all? That’s why forking it’s a thing. It’s certainly inconvenient but transferring the access of the original project to

Why would the registry do anything at all? That’s why forking it’s a thing. It’s certainly inconvenient but transferring the access of the original project to another party sets a very bad precedent. Maybe when the maintainer dies, but this guy is very much alive. It is his work and he chose to give it freely to others through an OSS license. That doesn’t automatically grant anybody access to the original project. If somebody wants and needs to keep updating it then they should just fork it. The left-pad issue is also different because in that case the original maintainer took it down which broke a bunch of packages that had dependencies on it. This project is still in the registry and it will still work as it is for the foreseeable future.

juliansimioni 7y ago
Here's a hypothetical, but extremely plausible scenario. Lets say tomorrow a major security vulnerability is discovered in CoreJS. Full root access because I'm making this all up. NPM says core-js has 19k dependents, so it would be very preferable if an X.Y.1 release could be pushed with a security only fix, to be picked up in as many projects as possible. In that case, I think it would be extremely reasonable for NPM to decide to take action. For example, they could take the package over themselves and publish a patch release. Or they could temporarily add maintainership to a trusted member of the community. No solution is without problems in this scenario, but there would be good arguments for either of those serious actions.
- qeternity 7y ago
  You're conflating two things: the npm package, and the GitHub repo. In your hypothetical, I agree with you that action would be needed: the repo should be forked and patched, and NPM should publish the new release as the official npm corejs package. This has accomplishes the same while trampling as little "ownership" as possible.

juliansimioni 7y ago

Here's a hypothetical, but extremely plausible scenario. Lets say tomorrow a major security vulnerability is discovered in CoreJS. Full root access because I'm making this all up. NPM says core-js has 19k dependents, so it would be very preferable if an X.Y.1 release could be pushed with a security only fix, to be picked up in as many projects as possible. In that case, I think it would be extremely reasonable for NPM to decide to take action. For example, they could take the package over themselves and publish a patch release. Or they could temporarily add maintainership to a trusted member of the community. No solution is without problems in this scenario, but there would be good arguments for either of those serious actions.

qeternity 7y ago
You're conflating two things: the npm package, and the GitHub repo. In your hypothetical, I agree with you that action would be needed: the repo should be forked and patched, and NPM should publish the new release as the official npm corejs package. This has accomplishes the same while trampling as little "ownership" as possible.