NPM Is Joining GitHub

Post by IsaacSchlueter » Mon, Mar 16, 2020, 10:56 PM UTC

lioeters wrote: post #202

oefrha wrote: post #164

Earlier quoted context omitted.

Repos have been able to provide artifacts since forever ago; they just don’t sit in the tree. While you can commit from an action, I’m not sure that’s a great idea.

You're right, artifacts in GitHub repos have been around a long time. I suppose what I was missing was a way to point to a specific built artifact (like a tar.gz from a release) as a dependency, from package.json. As far as I know, it's not possible yet with npm. I can imagine that will be covered somehow with deeper integration of GitHub and the NPM package repository.

Post by nine_k » Mon, Mar 16, 2020, 11:09 PM UTC

mulmen wrote: post #240

K0nserv wrote: post #185

Earlier quoted context omitted.

It depends on what the alternative is. When NPM starts running out of money to run the service what would happen? More VC, but only to a point and the firms would be increasingly be influencing NPM to make money by any means(probably not good for anyone but the firms). Alternatively a cash strapped NPM fails to invest in security and availability of the service leading to widespread outages or worse a large scale sup…

This is sad to read. Why does every project have to be profitable? If NPM is useful users (companies and people) can invest time or cash to support the operations and continued development. This foundation model has been successful across open source and prevents one company from changing the direction of a project to fit their own needs at the expense of everyone else. I think this was critical to the continued grow…

Post by IsaacSchlueter » Mon, Mar 16, 2020, 11:09 PM UTC

hinkley wrote: post #195

Normal_gaussian wrote: post #74

Earlier quoted context omitted.

yarn v1+ or yarn v2/berry? Switching to berry has been a huge PITA over here, but I don't want to give up workspaces

Our 'workspace' is so ornate that yarn couldn't handle it. 1.21+ almost looks right, but something very bad is still going on with mocha deduping, such that tests are failing with really bizarre error messages. I check yarn about every three months, or when I find a new, infuriating bug with the npm CLI (so, every couple of months on average). I think npm install suffers greatly from not having a formal spec. It has…

Post by kibwen » Mon, Mar 16, 2020, 11:16 PM UTC

timrod wrote: post #277

mbesto wrote: post #252

Earlier quoted context omitted.

> NPM being such an important pillar in the software supply chain while having an unviable business model and largely being funded by VC money was never a good position to be in. Why does NPM need to be funded as a commercial entity at all? What other open source library has a private company running its package manager? This one still boggles my mind.

For programming languages, there are several examples of commercially run package managers: - the Java/Kotlin/Scala ecosystem is based around maven central, which is run by Sonatype, Inc. - Go modules are hosted by Google. Previously, most libraries were hosted on Github - Rust's crate index is on Github - The Docker/Moby registry is run by Docker, Inc. (though that might be a stretch for "package manager" :))

Post by Dahoon » Mon, Mar 16, 2020, 11:24 PM UTC

manigandham wrote: post #337

judge2020 wrote: post #159

Earlier quoted context omitted.

Before someone else comes along and writes a monologue, the biggest downside might be how it handled (didn't break) its contract with ICE[0]. If the acquisition didn't happen, old GitHub might've dropped the contract immediately upon enough employees speaking about it. 0: https://news.ycombinator.com/item?id=21412600

That's a subjective political opinion of a far-left vocal minority. Not everyone has an issue with ICE (a federal law-enforcement agency that stops criminals and saves lives) nor finds a problem with a company legally providing services to the government.