3 ms·
If I was forced to wait to download my own package updates I would simply stop using npm altogether and use something else.
by herpdyderp 1y ago
If I was forced to wait to download my own package updates I would simply stop using npm altogether and use something else.
- balder1991 1y agoIt could be done like a rollout in % over time like app stores do.
- kaelwd 1y agoIt would be fine if you could still manually specify those versions eg. npm i duckdb@1.3.3 installs 1.3.3 but duckdb@latest or duckdb@^1.3 stays on 1.3.2 until 1.3.3 is ~a week old. https://github.com/pnpm/pnpm/issues/9921 https://github.com/pnpm/pnpm/issues/9921
- herpdyderp 1y agoBrilliantly simple, that would work for me!
- ApolloFortyNine 1y agoExcept they'd have to have an override for when there's a zero day, at which point we're back where we started.
- kaelwd 1y agoVersions with a serious vulnerability should be deprecated by the maintainer which then warns you to use a newer version when installing. Yes if a npm account is compromised the attacker could deprecate everything except their malicious version but it would still significantly reduce the attack surface by requiring manual intervention vs the current npm install foo@latest -> you're fucked.