4 ms·
> People didn't actively go seek out a new version. Yes, they did. Have you read the article ? That's how npm works: it always pulls the latest version. You c
by rakoo 5y ago
> People didn't actively go seek out a new version.
Yes, they did. Have you read the article ? That's how npm works: it always pulls the latest version.
You can't use tools you don't understand and blame someone else if it doesn't work as you expect it to.
- PragmaticPulp 5y ago> Yes, they did. Have you read the article ? That's how npm works: it always pulls the latest version. No, it pulls the specified version. The affected packages fixed it by removing the leading carpet in the version specifier, which was designed to allow patch version bumps for things like security fixes. He literally abused the versioning system designed to allow security fixes by introducing a breakage and disguising it as a non-breaking change.