61–69 of 69 posts
Earlier quoted context omitted.
Why would the typescript webpage mention Debian at all?
In telling you how to install it. That's kind of the point - they all assume you're going to use npm to install it.
Earlier quoted context omitted.
In telling you how to install it. That's kind of the point - they all assume you're going to use npm to install it.
Doesn't seem very far fetched to use a node package manager to install a node package tho?
Earlier quoted context omitted.
I get that it's a joke, but I feel the need to defend this project anyway. The problem with NPM isn't any one young package. The problem with the NPM is that any time you run 'npm install', you download potentially thousands of packages, and you get the most recent patch release from all of them. Installing one 1-day-old NPM package to forever avoid day 1 releases of thousands of packages seems like a worthwhile trad…
> The problem with NPM isn't any one young package. The problem with the NPM is that any time you run 'npm install', you download potentially thousands of packages, and you get the most recent patch release from all of them. Isn't this simply wrong? Last I checked, lock files work. They didn't for a long time, until a couple of years ago, as far as I know. If you delete your lock file or explicitly run a package upgr…
I’ve always preferred exact versions because I’d rather updates be opt-in rather than an opt-out footgun. Otherwise any new dev to the project might accidentally pull some new version of a package that satisfies the semver requirement but modifies the lockfile, then they’ll check it into the code, and it’s another thing to fix at review time… there’s just a lot less friction if you use exact versions. It makes hermetic/reproducible builds and static dependency analysis easier, too.
Of course you need some update hygiene, preferably via an automated bot that opens PRs and runs tests. Renovate works well.
(btw, this same issue occurs with Docker base images; it’s better to base images on the sha256sum of the target image rather than a floating tag. Renovate can update those too.)
Earlier quoted context omitted.
Established Linux distributions.
Sure. But I'm not sure if I wanted to burden their package registry maintainers with maintaining all kinds of JS/TS packages? And if you go for custom registries, what's the big difference to npm registry? I don't understand it :) One good thing about npm ecosystem IMO is that it's frowned upon to depend on system globals.
Earlier quoted context omitted.
Recently decided to learn typescript. You would hardly know there's a Debian package from reading typescript's website.
Why would the typescript webpage mention Debian at all?
Earlier quoted context omitted.
And do you think the severity of the issue is anywhere near the same?
I think this will remain to be seen. Wasn't there a paper linked here on HN recently, that claimed, that even few examples are sufficient, to poison LLMs? (I didn't read that paper, and merely interpreted the meaning of the title.)
Earlier quoted context omitted.
Established Linux distributions.
Sure. But I'm not sure if I wanted to burden their package registry maintainers with maintaining all kinds of JS/TS packages? And if you go for custom registries, what's the big difference to npm registry? I don't understand it :) One good thing about npm ecosystem IMO is that it's frowned upon to depend on system globals.
https://packages.debian.org/trixie/node-pg https://packages.debian.org/trixie/webpack https://packages.debian.org/trixie/eslint
So someone is already taking on that burden.
As someotherguyy already mentioned, this is a default feature in pnpm. And as far as cat-and-mouse-games go in other package managers, I'd say that pinning dependencies and disabling postinstall scripts is a much better option. Sure, not a foolproof one either, but as good as it gets. edit: misspelled someotherguyy's user name
I recently learned that this is (for all intents and purposes) a feature in npm as well, specifically the `--before` flag to `npm install`: https://docs.npmjs.com/cli/v11/commands/npm-install#before . That was harder than it should've been to figure out; it really needs better marketing. Related to that is the proposal for `stabilityDays`, which seems way more practical: https://github.com/npm/cli/issues/8570#issueco…
Earlier quoted context omitted.
Why would the typescript webpage mention Debian at all?
Upstreams often mention distros in which their software is packaged, how the package is called and sometimes even the commands to install it.
Don't know why the TS team would point to a 3 year old fork of something they don't have control over.