npm Blog Archive: Release v7.1.0
The npm blog has been discontinued. Updates from the npm team are now published on the GitHub Blog and the GitHub Changelog. Happy Friday! 🎉 This week’s release brings two new features, starting with a brand new command: npm set-script that helps you manage your package.json scripts - thanks to the community contribution from @Yash-Singh1 🏆 Also npm exec (no args) now triggers an interactive sub
npm Blog Archive: Release v7.0.0-rc.0
The npm blog has been discontinued. Updates from the npm team are now published on the GitHub Blog and the GitHub Changelog. 🎉 Happy Thursday! Over the past few months the cli team has been working hard to ship a release each week to clean up & stabilize the npm v7 beta; We’re excited about where we are today & have cut our first release candidate this morning. Our intent is to continue to ship w
npm Blog Archive: npm v7 Series - Beta Release! And: SemVer-Major Changes in npm v7
The npm blog has been discontinued. Updates from the npm team are now published on the GitHub Blog and the GitHub Changelog. << Why keep package-lock.json? A new beta version of npm appears! tl;dr - Run npm i -g npm@next-7 right now, and tell us about any problems you encounter with it. This is a big one, you’re going to want to check it out. As with any beta software, it’s likely to still have a
npm Blog Archive: npm v7 Series - Why Keep `package-lock.json`?
The npm blog has been discontinued. Updates from the npm team are now published on the GitHub Blog and the GitHub Changelog. << Arborist Deep Dive >> Beta Release! One common question we’ve gotten a few times now, once we announce that npm v7 will include support for yarn.lock files, is “Why keep package-lock.json at all, then? Why not just use yarn.lock only?” The simple answer is: because yarn.l
npm Blog Archive: npm v7 Series - Arborist Deep Dive
The npm blog has been discontinued. Updates from the npm team are now published on the GitHub Blog and the GitHub Changelog. << Introduction >> Why Keep package-lock.json? @npmcli/arborist is the dependency tree manager for npm, new in npm v7. It provides facilities for doing nearly everything that npm does with package trees, and fully replaces large parts of the npm CLI codebase. Way back in the
npm Blog Archive: npm v7 Series - Introduction
The npm blog has been discontinued. Updates from the npm team are now published on the GitHub Blog and the GitHub Changelog. >> Arborist Deep Dive Quite a lot has happened in npm since our last update way back in 2019. We’re overdue for a status update on npm v7. Despite some massive distracting changes (some unfortunate, some very fortunate), development work has been proceeding steadily. Yesterd
The npm Blog — Changes to npm Unpublish Policy - January 2020
TL;DRUntil today, you couldn’t unpublish packages, or package versions, older than 72 hours without contacting support (background available here and here). Because this is our most popular support request, we’ve extended the ability for you to unpublish packages beyond 72 hours if your package meets certain criteria. What are we doing?npm has grown a lot over the past 10 years, and rapid growth m
npm Blog Archive: Binary Planting with the npm CLI
The npm blog has been discontinued. Updates from the npm team are now published on the GitHub Blog and the GitHub Changelog. tl;dr - Update to npm v6.13.4 as soon as possible on all your systems to fix a vulnerability allowing arbitrary path access. The Vulnerabilities In versions of npm prior to 6.13.3 (and versions of yarn prior to 1.21.1), a properly constructed entry in the package.json bin fi
npm Blog Archive: Updates to Community, Docs & more...
The npm blog has been discontinued. Updates from the npm team are now published on the GitHub Blog and the GitHub Changelog. Happy Tuesday! Here on the Community & Open Source Team we’ve been working hard, in front of and behind the scenes, to provide real value and unlock developer potential. With that in mind, I’m happy to announce a number of updates/releases we’ve landed this morning & would l
npm Blog Archive: Release: 6.12.1
The npm blog has been discontinued. Updates from the npm team are now published on the GitHub Blog and the GitHub Changelog. A new npm version has been released! This fixes some bugs, including no longer claiming to not support node v13. Get it in the usual ways: npm i -g npm@latest 6.12.1 (2019-10-29) BUG FIXES 6508e833d #269 add node v13 as a supported version (@ljharb) b6588a8f7 #265 Fix regres
npm Blog Archive: kik, left-pad, and npm
The npm blog has been discontinued. Updates from the npm team are now published on the GitHub Blog and the GitHub Changelog. Earlier this week, many npm users suffered a disruption when a package that many projects depend on — directly or indirectly — was unpublished by its author, as part of a dispute over a package name. The event generated a lot of attention and raised many concerns, because of
npm Blog Archive: npm CLI Roadmap - Summer 2019
The npm blog has been discontinued. Updates from the npm team are now published on the GitHub Blog and the GitHub Changelog. Motion on the npm CLI project has been accelerating, and we’re now moving forward with a clear direction and vision. This document outlines what’s in store for the remainder of the npm v6 line, and what to expect in v7 and v8. Remaining npm v6 Releases npm v6 is officially i
npm Blog Archive: Monorepos and npm
The npm blog has been discontinued. Updates from the npm team are now published on the GitHub Blog and the GitHub Changelog. Splitting a large, monolithic codebase into small, encapsulated modules is usually good practice from an architectural perspective. Modularization is useful for everything from microservices to libraries of reusable components. However, it can also be a nightmare from a publ
npm Blog Archive: A new chapter for npm
The npm blog has been discontinued. Updates from the npm team are now published on the GitHub Blog and the GitHub Changelog. Not to bury the lede: I have resigned from npm. I made the decision to leave in early May, and my final full-time day was July 1st, but as a co-founder it takes a long time to untangle yourself so I will be helping with transition-related tasks until they are wrapped up. I j
npm Blog Archive: Protecting Package Publishers: npm Token Security and Hygiene now Extend to GitHub
The npm blog has been discontinued. Updates from the npm team are now published on the GitHub Blog and the GitHub Changelog. Protecting Package Publishers: npm Token Security and Hygiene now Extend to GitHub Today, we’re excited to announce that, in collaboration with GitHub’s token scanning partnership program, we’ve taken our existing token revocation efforts a step further. Whenever you commit
npm Blog Archive: The security risks of changing package owners
The npm blog has been discontinued. Updates from the npm team are now published on the GitHub Blog and the GitHub Changelog. When I ask software developers what their biggest security concerns are, I typically hear something about malicious code in their npm packages. The average npm package has over 2000 dependencies, so the worry over malware makes a lot of sense. The npm security team certainly
npm Blog Archive: Continuous Security
The npm blog has been discontinued. Updates from the npm team are now published on the GitHub Blog and the GitHub Changelog. It’s been almost a year since npm acquired ^Lift Security and even less since the official formation of the internal npm Security Team. In addition to working on securing the Registry and its users, I’ve been setting aside time to think through how we look at security at npm
リリース、障害情報などのサービスのお知らせ
最新の人気エントリーの配信
j次のブックマーク
k前のブックマーク
lあとで読む
eコメント一覧を開く
oページを開く
npm Blog Archive: npm Security 2019 in Review
npm Blog Archive: Managing JavaScript in the Enterprise
npm Blog Archive: Automated token revocation for when you accidentally publish a token