4 ms·

Sure version tags could also move, but by convention they do not. Unlike the latest tag, which by convention does move a lot.

• isbvhodnvemrwvn 5y ago
  By convention npm packages are not deleted or hijacked.
  • fuzzy2 5y ago
    You do realize that NPM package versions already are immutable? Dunno since when though. Deletion is possible within limits but it also is with Docker. All the hashes in the world won't bring back a deleted image.
    • keymone 5y ago
      version numbers are never immutable. they are arbitrary labels that are created by some centralized authority and can be changed by that same authority. artifacts being removed is much less of a problem as artifacts being spoofed with malicious content.
    • isbvhodnvemrwvn 5y ago
      They were made immutable after the issue was already widespread. Which is also why I'd heavily encourage to use hashes to pin container versions, even though people might not see the immediate need to do so.