Bookmarks (26) clear filters

npm 7.3.0 (and 7.2.0) Released — Two new npm releases dropped in just before Christmas. npm config now supports getting and setting multiple values at once and npm rebuild now accepts paths as an argument.

npm v7.0.9 Released — Bug fixes via dependency upgrades and start is now the default script when server.js is present.

npm v7.0.0 Beta 13 Released — Adds support for --fetch-timeout to customize the timeout for fetching resources (by default, supposedly zero in npm 6 but to be 5 minutes in npm 7).

npm v7.0.0 Beta 11 Released — Beta 10 was meant to be the last beta before RC but a few things came up.. 😄

npm v7.0.0 Beta 10 Released — Isaac says this should be the last beta v7 release with release candidates due to start next week.

npm v7 Series Now in Beta — Isaac is back bearing good news: there’s a new major beta version of npm. Run npm i -g npm@next-7 to try it now, but he notes it’s “a big one” and there are rough edges and breaking changes ahead. Trouble-free improvements are promised for the majority of users, but this post digs into the changes if you...

npm 6.14.8 Released — “A new v6 patch release is out with a few bug fixes from the community and dependency updates.”

npm v7 Series: Why Keep package-lock.json? — If npm v7 is going to support yarn.lock files, then why keep package-lock.json around as well? Isaac goes into some depth as to how yarn.lock works and why it doesn’t quite suit every use case npm covers.

The npm v7 Series: An Arborist Deep Dive — Isaac Schlueter is back, as promised, taking a serious deep dive into npm v7. This time, he explains how the Arborist dependency tree (or, rather, graph) manager works.

npm 6.14 Released — The main addition is support for multiple ‘funding’ entries for package maintainers to demonstrate multiple ways their work can be supported. 6.14.1 followed shortly thereafter to fix a regression.

Changes to npm's 'Unpublish' Policy — Till now you couldn’t easily ‘unpublish’ packages (or individual versions) from the main npm repository if they were older than 72 hours but now you can if your package meets certain criteria (no dependents, fewer than 300 downloads in the past week, and a single owner/maintainer).

npm 6.13.4 Released, Please Upgrade — There have been two key bugfix releases this week – this is the latest. Why upgrade? Because in npm 6.13.2 and earlier, a nefarious package publisher could put something into their package.json that would let them modify arbitrary files on your system. Luckily, no examples of this attack have yet been found by npm’s security team.