←back to thread

2525 points hownottowrite | 2 comments | | HN request time: 0.729s | source
Show context
Aozi ◴[] No.21190660[source]
What we need is a JS developer to take down an important package from NPM in protest, thus breaking the Internet again.
replies(2): >>21190743 #>>21194973 #
byte1918 ◴[] No.21190743[source]
The NPM fiasco should no longer be possible

If you want to unpublish a package after 72 hours have passed, contact npm Support. For more information about why we don’t allow users to unpublish packages after 72 hours, see our unpublish policy.

https://docs.npmjs.com/unpublishing-packages-from-the-regist...

replies(4): >>21190798 #>>21190801 #>>21190806 #>>21191523 #
Crinus ◴[] No.21190806[source]
Not sure how npm works in detail, doesn't it pull directly from devs' repositories? In that case can't the devs just publish an update that breaks everything?
replies(2): >>21190848 #>>21190870 #
1. parsimo2010 ◴[] No.21190870[source]
npm allows for installation of specific versions. So even if a dev publishes a new version that breaks you can select a previous version known to work. A good dev shouldn’t be updating willy-nilly to the latest version just because it’s the latest. They ought to spec a particular version and update after testing.
replies(1): >>21191856 #
2. monocasa ◴[] No.21191856[source]
Doesn't npm allow a dev to replace or redact already released versions?