How new version of NPM package "colors" broke millions of installs

This page summarizes the projects mentioned and recommended in the original post on reddit.com/r/node

Our great sponsors
  • Appwrite - The Open Source Firebase alternative introduces iOS support
  • Scout APM - Less time debugging, more time building
  • SonarQube - Static code analysis for 29 languages.
  • colors.js

    get colors in your node.js console

    I started with the first most obvious `colors` (https://www.npmjs.com/package/colors). It was recently updated from 1.4.0 to 1.4.2, but there is catch. The code for 1.4.2 is not published on official github page. There no tag or release with 1.4.2 (https://github.com/Marak/colors.js). So I installed and saved both version and did a diff on them, and here is the difference:

  • nest-cli

    CLI tool for Nest applications 🍹

    We ran into this last night with the @nestjs/cli. The code itself doesn't depend on colors, but cli-table3, which we had a pinned version of did depend on colors, and didn't have the dependency pinned. So when 1.4.2 was released, introducing the bug, we go flooded with reports that nest new and nest help started failing all of a sudden. Fortunately, cli-table3 had a patch to downgrade the colors dependency, and are looking at removing it altogether, but the cascading effect was quite annoying to deal with.

  • Appwrite

    Appwrite - The Open Source Firebase alternative introduces iOS support . Appwrite is an open source backend server that helps you build native iOS applications much faster with realtime APIs for authentication, databases, files storage, cloud functions and much more!

  • berry

    📦🐈 Active development trunk for Yarn ⚒

    Depends on your package manager then. pnpm and yarn both support the resolutions property in the package.json so you can do

NOTE: The number of mentions on this list indicates mentions on common posts plus user suggested alternatives. Hence, a higher number means a more popular project.

Suggest a related project

Related posts