npm Blog Archive: npm v7 Series - Beta Release! And: SemVer-Major Changes in npm v7
The npm blog has been discontinued. Updates from the npm team are now published on the GitHub Blog and the GitHub Changelog. << Why keep package-lock.json? A new beta version of npm appears! tl;dr - Run npm i -g npm@next-7 right now, and tell us about any problems you encounter with it. This is a big one, you’re going to want to check it out. As with any beta software, it’s likely to still have a
npm Blog Archive: npm v7 Series - Arborist Deep Dive
The npm blog has been discontinued. Updates from the npm team are now published on the GitHub Blog and the GitHub Changelog. << Introduction >> Why Keep package-lock.json? @npmcli/arborist is the dependency tree manager for npm, new in npm v7. It provides facilities for doing nearly everything that npm does with package trees, and fully replaces large parts of the npm CLI codebase. Way back in the
npm Blog Archive: Next Phase Montage
The npm blog has been discontinued. Updates from the npm team are now published on the GitHub Blog and the GitHub Changelog. tl;dr – Good news! npm, Inc., is being purchased by GitHub. The public registry remains public, free, and as available as ever. npm as you know it continues, and in fact, there is good reason to believe that it’ll only get better. I’m still going to be working on npm (but wi
The npm Blog — Changes to npm Unpublish Policy - January 2020
TL;DRUntil today, you couldn’t unpublish packages, or package versions, older than 72 hours without contacting support (background available here and here). Because this is our most popular support request, we’ve extended the ability for you to unpublish packages beyond 72 hours if your package meets certain criteria. What are we doing?npm has grown a lot over the past 10 years, and rapid growth m
npm Blog Archive: Monorepos and npm
The npm blog has been discontinued. Updates from the npm team are now published on the GitHub Blog and the GitHub Changelog. Splitting a large, monolithic codebase into small, encapsulated modules is usually good practice from an architectural perspective. Modularization is useful for everything from microservices to libraries of reusable components. However, it can also be a nightmare from a publ
npm Blog Archive: Continuous Security
The npm blog has been discontinued. Updates from the npm team are now published on the GitHub Blog and the GitHub Changelog. It’s been almost a year since npm acquired ^Lift Security and even less since the official formation of the internal npm Security Team. In addition to working on securing the Registry and its users, I’ve been setting aside time to think through how we look at security at npm
npm Blog Archive: npm, Inc. has a new CEO, Bryan Bogensberger
The npm blog has been discontinued. Updates from the npm team are now published on the GitHub Blog and the GitHub Changelog. Coming up as a software developer in Open Source, I’ve long believed that the best path to success is to depend on the strengths of others. One reason why I wrote a package manager in the first place was that I knew the JavaScript community as a whole could write a much bett
npm Blog Archive: Next Generation Package Management
The npm blog has been discontinued. Updates from the npm team are now published on the GitHub Blog and the GitHub Changelog. What if installs were so fast they could happen in the background, just by using Node? What if every file in your dependencies could be guaranteed to be bit-by-bit identical to what’s on the registry? What if working on a new project was as simple as clone and run? What if y
npm Blog Archive: The Node Security Platform service is shutting down 9/30
The npm blog has been discontinued. Updates from the npm team are now published on the GitHub Blog and the GitHub Changelog. Earlier this year, we announced npm, Inc.’s acquisition of ^Lift Security and the Node Security Platform and promised to provide updates as our teams combined to protect the world’s largest JavaScript developer community. Today, we have some news about how the acquisition af
The npm Blog — Introducing `npm ci` for faster, more reliable...
The npm blog has been discontinued. Updates from the npm team are now published on the GitHub Blog and the GitHub Changelog. Starting today, all npm users can take advantage of a new install command called npm ci. The command offers massive improvements to both the performance and reliability of builds for continuous integration / continuous deployment processes, providing a consistent and fast ex
npm Blog Archive: npm operational incident, 6 Jan 2018
The npm blog has been discontinued. Updates from the npm team are now published on the GitHub Blog and the GitHub Changelog. The npm registry had an operations incident Saturday that caused 97 packages to be temporarily unavailable for download for approximately 30 minutes, and an additional 9 packages to be unavailable for approximately three hours. Early this coming week, we will share a full an
npm Blog Archive: `crossenv` malware on the npm registry
The npm blog has been discontinued. Updates from the npm team are now published on the GitHub Blog and the GitHub Changelog. On August 1, a user notified us via Twitter that a package with a name very similar to the popular cross-env package was sending environment variables from its installation context out to npm.hacktask.net. We investigated this report immediately and took action to remove the
npm Blog Archive: v5.0.0
The npm blog has been discontinued. Updates from the npm team are now published on the GitHub Blog and the GitHub Changelog. Wowowowowow npm@5! This release marks months of hard work for the young, scrappy, and hungry CLI team, and includes some changes we’ve been hoping to do for literally years. npm@5 takes npm a pretty big step forward, significantly improving its performance in almost all comm
npm Blog Archive: package tarball read outage today
The npm blog has been discontinued. Updates from the npm team are now published on the GitHub Blog and the GitHub Changelog. Earlier today, July 6, 2016, the npm registry experienced a read outage for 0.5% of all package tarballs for all network regions. Not all packages and versions were affected, but the ones that were affected were completely unavailable during the outage for any region of our
npm Blog Archive: npm registry is now fully HTTPS!
The npm blog has been discontinued. Updates from the npm team are now published on the GitHub Blog and the GitHub Changelog. Effective yesterday morning, all requests to the npm registry are made via HTTPS. What’s different npm has accepted HTTPS or HTTP requests for some time. (In fact, only the initial hop from your client to Fastly, our CDN, would use HTTP.) We returned most data to you via HTT
npm Blog Archive: fixing a bearer token vulnerability
The npm blog has been discontinued. Updates from the npm team are now published on the GitHub Blog and the GitHub Changelog. Last week, npm@2.15.1 (npm LTS) and npm@3.8.3 were released to latest. Among other improvements, these fix a vulnerability that could cause the unintentional leakage of bearer tokens. Here are details on this vulnerability and how it affects you. How to update npm An up to d
npm Blog Archive: changes to npm’s unpublish policy
The npm blog has been discontinued. Updates from the npm team are now published on the GitHub Blog and the GitHub Changelog. Note: as of January 30, 2020, the unpublish policy has been updated. One of Node.js’ core strengths is the community’s trust in npm’s registry. As it’s grown, the registry has filled with packages that are more and more interconnected. A byproduct of being so interdependent
npm Blog Archive: Package install scripts vulnerability
The npm blog has been discontinued. Updates from the npm team are now published on the GitHub Blog and the GitHub Changelog. Disclaimer: we had been told this vulnerability would be disclosed on Monday, not Friday, so this post is a little rushed and may be edited later. As disclosed to us in January and formally discussed in CERT vulnerability note VU#319816, it is possible for a maliciously-writ
リリース、障害情報などのサービスのお知らせ
最新の人気エントリーの配信
j次のブックマーク
k前のブックマーク
lあとで読む
eコメント一覧を開く
oページを開く
npm Blog Archive: npm Acquires ^Lift Security and Node Security Platform
npm Blog Archive: npm has a new CTO