news.volyx.in

Upcoming breaking changes for npm v12 (github.blog)

484 points by plasma · 80 days ago · 208 comments on HN

Article summary

The upcoming npm version 12 will introduce security-related changes, including defaulting to not executing scripts from dependencies and not resolving Git dependencies or remote URLs unless explicitly allowed. These changes are available behind warnings in the current npm version 11.16.0 and later, allowing users to prepare before the upgrade. The changes aim to improve security by requiring explicit opt-in for potentially risky behaviors. The estimated release date for npm version 12 is July 2026.

Main themes

  • npm security updates
  • GitHub and Microsoft ownership
  • Package management
  • Supply chain attacks
  • Open source and proprietary software

What commenters say

  • The changes in npm version 12 are a result of Microsoft's influence and ownership of GitHub, which has led to a more secure and controlled environment.
  • The acquisition of npm by GitHub, which is owned by Microsoft, has had a negative impact on the company and its employees, with many staff engineers being fired.
  • Microsoft's ownership of GitHub has not led to the expected negative consequences, and the company has adopted more open-source practices, such as making VS Code open source.
  • The problem of supply chain attacks in the npm ecosystem is not unique to npm and is a broader issue in the software industry, with other package repositories also having similar problems.
  • The idea that Microsoft has changed and is now more open-source friendly is disputed, with some arguing that the company's actions are still driven by a desire for control and profit.
  • The layoffs at npm before its acquisition were likely due to financial difficulties, but this claim is disputed and seen as an attempt to justify the acquisition.
  • The criticism of Microsoft's ownership of GitHub and npm is not just about the companies themselves, but also about the broader issue of corporate power and control in the tech industry.
  • The notion that technology companies, including Microsoft, have been a force for evil rather than good is a controversial opinion that is not universally accepted.