Skip to content

Latest commit

 

History

History
86 lines (71 loc) · 4.93 KB

2021-08-11.md

File metadata and controls

86 lines (71 loc) · 4.93 KB

Meeting from: August 11th, 2021

Open RFC Meeting (npm)

Attendees

  • Darcy Clarke (@darcyclarke)
  • Gar (@wraithgar)
  • Nathan Fritz (@fritzy)
  • Isaac Z. Schlueter (@isaacs)
  • Luke Karrys (@lukekarrys)
  • Tierney Cyren (@bnb)
  • Nathan LaFreniere (@nlf)
  • Alasdair Hurst (@alasdairhurst)

Previously...

Agenda

  1. Housekeeping
    1. Introduction(s)
    2. Code of Conduct Acknowledgement
    3. Outline Intentions & Desired Outcomes
    4. Announcements
  2. Audit Improvements:
    1. Review Action Items from previous deep-dive call
    2. PR: #18 npm audit and audit-resolve.json - @naugtur
    3. PR: #182 RFC: npm audit licenses - @bnb
    4. PR: #422 RFC: audit assertions - @bnb
  3. RFC: #397 Peer dependencies should be able to match a full range of prerelease versions - @alasdairhurst
  4. RRFC: #430 Improving workspace terminology - @jasonwilliams
  5. RRFC: #428 npm publish should tell you the end point it's pushing too. - @EvanCarroll
  6. RRFC: #427 npmrc file improvements - @EvanCarroll
  7. RRFC: #425 npm-unpublish should have some type of warning when unpublishing package - @pranavkhapra

Notes

Review Action Items from previous deep-dive call

  • @darcyclarke will provide an update &/or reference to backlogged work to be done to investigate UX/UI npm audit improvements
PR: #18 npm audit and audit-resolve.json - @naugtur
PR: #182 RFC: npm audit licenses - @bnb
  • @bnb no update
  • @isaacs notably the license SPDX string is not being included in lockfiles (will need to be added to corgi docs)
  • Action: queue up adding the metadata to corgi docs w/ the registry team
PR: #422 RFC: audit assertions - @bnb
  • @bnb: updated PR with some information, will update a bit more in-meeting to address "limiting scope"
  • npm/cli#3452

RRFC: #430 Improving workspace terminology - @jasonwilliams

  • @isaacs
    • ~"language is hard"
    • provided feedback/insight in the originating discussions here: npm/feedback#510
  • @darcyclarke
    • has tried to map/visualize these terms as they relate to a
    • Action: make PR to amend original Workspaces RFC a picture/visual of our terminology w/ glossary
  • @fritzy
    • believe our definition is fine so long as we're consistent & glossary is explicit
  • Action: Add glossary to npm/cli docs (rough draft)
  • Action: editorial pass through existing npm/cli docs to make sure we're using these terms properly
  • Action: (nice to have) Automatically link words in docs to their glossary definitions (this might be too noisy/complicated?)

RRFC: #428 npm publish should tell you the end point it's pushing too. - @EvanCarroll

  • @naugter would be nice to have it print prior to 2fa prompt
  • Action: add registry target config output when using npm publish
  • Action: consider other commands that we may want to provide this output/context (start with write operations at first)

RRFC: #427 npmrc file improvements - @EvanCarroll

  • @isaacs
    • have been considering improvements internally
    • this initial discussion/issue doesn't go as far as we'd like if we're going to make a breaking change to .npmrc/config
    • npm install --regsitry=foo <- typos don't throw (ie. infinite options/config)
    • lets eliminate nopt
  • @naugter
    • consider making this an ecosystem package first & make it optional before shipping it by default
  • @darcyclarke
    • what about something like --thrown-on-unkown to curb the infinite supported config problem we have today
  • Action: audit config / propose a more comprehensive RFC

RRFC: #425 npm-unpublish should have some type of warning when unpublishing package - @pranavkhapra

  • @wraithgar want to be mindful that this would be specific to the npm public regitry's policies
  • @naugter this shouldn't be that distructive given the current policy around a 24hr window