rfcs
corepack
Our great sponsors
rfcs | corepack | |
---|---|---|
35 | 5 | |
713 | 2,073 | |
0.8% | 6.9% | |
5.6 | 8.7 | |
17 days ago | 1 day ago | |
JavaScript | TypeScript | |
GNU General Public License v3.0 or later | MIT License |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
rfcs
-
Yarn 4.0
npm workspaces plus Wireit works far better than Lerna, in my experience.
https://github.com/google/wireit
Wireit's ability to specify actual script dependencies, do caching (and on Github actions), and it's long-running service script support make it much more useful and comprehensive than Lerna.
I agree that this should be built into npm. There's an RRFC for it here: https://github.com/npm/rfcs/issues/706
-
How do you know that the .exe or .apk file for an open source software on github is actually compiled from the viewable source code?
This just got accepted as a proposal in NPM: https://github.com/npm/rfcs/pull/626
-
Why aren't Node.js package managers interoperable?
npm also plans to support pnpm-style node_modules
-
Axios shipped a buggy version and it broke many productions apps. Let this be a lesson to pin your dependencies!
(I usually end up removing npm ci from CI/CD since I think it is way too slow and want to cache node_modules from previous builds; I'm waiting for https://github.com/npm/rfcs/issues/415 to land to make this fail-safe npm install --from-lockfile. Yarn does support this already)
- Lerna has gone. Which Monorepo is right for a Node.js BACKEND now?
-
How to respond to growing supply chain security risks?
I started following this problem from the discussion at npm about making install scripts opt-in. But install scripts are not the only threat, there are more ways for malicious actors:
-
On node-ipc and the importance of trusting trust
What I’m proposing is specifically in cases where sub-dependencies may have a known vulnerability but that isn’t in any of the call paths of your direct dependency. It’s an alternative to the “audit assertions”[1] proposal, which I find problematic for reasons I discussed there before I bowed out. My idea is that you can be confident you’re not affected by a vulnerability in a dependency (at any depth), if that vulnerability is no longer in the code in the first place.
It also reduces the surface area to vet in the first place. It’s highly likely many dependencies will be stripped down considerably, if not outright deduplicated or eliminated. The “npm installs thousands of dependencies” thing is a real problem, but it’s also partly because it’s installing stuff you’ll never actually execute in any way.
You can pare down sub-dependencies with confidence, because you already know what code paths are hit by the parent dependency at packaging time. You can’t do that with direct dependencies until you go to package/deploy, because of course you may expand your usage of their APIs during development.
-
On the Weaponisation of Open Source
https://github.com/npm/rfcs/issues/509
it more or less just makes it difficult for updates to propogate, which is arguably a good thing.
- BIG sabotage: Famous npm package (node-ipc) deletes files to protest Ukraine war
-
Pitfalls When Adding Turborepo To Your Project
Even if you run npm install, only npm 7 and up support workspaces. There is no straightforward way to enforce developer npm version although it is not impossible, so you might want to document the version requirement in your root README. A developer without npm 7+ will end up with unresolved modules in their editor.
corepack
-
Yarn 4.0
I'd love to use Bun for my projects, but it's not integrated into Corepack yet (and therefore you cannot pin the bun version w/ checksum in package.json)
-
Every NPM package potentially compromised
Recently Node 16 LTS cycle started. One month and a few days before the carry-over, a super controversial package titled `coredeps` [0] was officially declared a core module and has been bundled with all official distributions since.
The NodeJS team refuses to discuss NPM because it's a separate 3rd party. And yet.... this NodeJS Core module comes pre-installed as a global NPM package.
We're just getting started.
This module installs or even reinstalls any supported package manager when you execute a script with a name that would match any that they'd recognise. Opt-in for only a short period, and intending to expand beyond package manager installations.
Amidst all that's been going on, NPM (Nonstop Published Moments) is working on a feature that silently hijacks user commands and installs foreign software. The code found in those compromised packages operated in a similar manner and was labeled a critical severity vulnerability.
The following might actually make you cry.
Of these third party remote distributions it's downloading, the number of checksum, keys, or even build configurations that are being verified is 0.
The game that Microsoft is playing with their recent acquisitions here is quite clear, but there's too much collateral damage.
-
Corepack: the Node.js' manager of package managers
The new Node.js LTS v16 will be released at the end of October (without a fancy name assigned yet), it'll have Corepack preinstalled in the default configuration since v16.9.0. 👌
-
Yarn 3.0 🚀🤖 Performances, ESBuild, Better Patches, ...
Corepack integration
What are some alternatives?
nvm - Node Version Manager - POSIX-compliant bash script to manage multiple active node.js versions
npm
asdf - Extendable version manager with support for Ruby, Node.js, Elixir, Erlang & more
vscode-deploy-reloaded - Recoded version of Visual Studio Code extension 'vs-deploy', which provides commands to deploy files to one or more destinations.
berry - 📦🐈 Active development trunk for Yarn ⚒
node - Node.js JavaScript runtime ✨🐢🚀✨
vm2 - Advanced vm/sandbox for Node.js
verdaccio - 📦🔐 A lightweight Node.js private proxy registry
ultra-runner - 🏃⛰ Ultra fast monorepo script runner and build tool
pnpm - Fast, disk space efficient package manager
syncpack - Consistent dependency versions in large JavaScript Monorepos.
Cargo - The Rust package manager