Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps

Re:Dev corrupts NPM libs 'colors' and 'faker', breaking thou... by prepend on Monday January 10, 2022 @08:33AM (#29874500)

The package ecosystem is growing and there’s more good packages each year. 10 years isn’t 30, but it’s still a long time to show success.

That’s there’s only been a few problems like this despite millions of users is a sign of strength.

I hedge by pinning yo specific versions and keeping my own package manager (RStudio) to keep mirrors if the packages I scan. That the packages are open source means they are easier to scan or fork.

If a maintainer stops then the project can be forked. If nobody wants to fork then that probably means no one cares enough. And that’s ok.

Mostly it forces us to be flexible. I don’t think software is a thing but a process or cycle.

[ Parent | on HN ]

Re:Dev corrupts NPM libs 'colors' and 'faker', breaking thou... by marcus_holmes on Monday January 10, 2022 @09:03AM (#29874927)

Success != sustainability.

If a thing has an expiry date that is >10 years, then you're not going to see any problems for 10 years. That doesn't mean the expiry date doesn't exist, or that the thing won't hit it. It can be wildly successful for all those years and then hit the expiry date and stop immediately.

[ Parent | on HN ]

Re:Dev corrupts NPM libs 'colors' and 'faker', breaking thou... by prepend on Tuesday January 11, 2022 @06:13PM (#29899794)

It’s not necessarily the same, but it’s a good co-signal. And definitely useful for refuting emotional, data less calls that the sky is falling.

I’ll take a decade of success as a sign of sustainability over a package maintainer losing their shit as a sign of h sustainability.

[ Parent | on HN ]