I completely agree with this sentiment, but just because you can't change the code for a specific version number doesn't mean you can't add code with the same effective semver range...
If I publish v0.5.4 and then realize it's got a serious flaw and I need to unpublish, I can still republish, say, v0.5.4+fix1 or some such. I'm not sure how npm handles sorting on these suffixes but I suspect it's alphanumeric, and takes priority over the old v0.5.4. From the docs: 1.2.3 A specific version. When nothing else will do. Note that build metadata is still ignored, so 1.2.3+build2012 will satisfy this range. It looks like that's at least one way to do it. On Thu, Dec 19, 2013 at 6:02 PM, Mikeal Rogers <[email protected]>wrote: > In the real world it's just better to have your dependents not fail to > install, you can't actually rely on the maintainers doing another publish > after you break them. In the end, the less packages that fail to install > from npm the better and whatever solution results in the least number of > un-installable packages sitting in the registry is the one we should go > with. > > -Mikeal > > On Dec 19, 2013, at 2:59PM, Alex Kocharin <[email protected]> wrote: > > > Why is it a bad thing? > > If someone wants to receive your update, he'll specify a version range and > an update will be installed automatically. > > If someone want to rely specifically on broken version and locked it, they > kinda asked for it. > > Well yeah, unpublishing is bad except for very few cases where public data > is leaked. But when you do that, don't republish the same version ever > again. It'll mess up things. I like to see how npm v1.3.19 is missing from > registry for example. > > > 20.12.2013, 02:27, "Mikeal Rogers" <[email protected]>: > > That leaves all of the other packaged already published and relying on a > specific version broken. > > On Dec 19, 2013, at 11:46AM, Dean Landolt <[email protected]> wrote: > > Even in that case it would still seem better to allow unpublish and bump > the version number, right? > > Immutability (plus unpublish) would make the npm registery an even better > place. > > > On Thu, Dec 19, 2013 at 2:43 PM, Mikeal Rogers <[email protected]>wrote: > > There have also been security issues where old packages were shipped with > sensitive information that needed to be ripped out. > > On Dec 18, 2013, at 5:07PM, Forrest L Norvell <[email protected]> > wrote: > > I agree that packages should rarely be changed, but in practice if there's > a major bug or the packaging gets totally botched (which has happened to me > a few ties), it's good to have the ability to fix the problem in-place. I'm > less enamored on the possibility of removing packages once they've been > published. That seems like it's almost always a bad idea, and I would be in > favor of altering the registry to disallow it. > > F > > > On Wed, Dec 18, 2013 at 12:41 PM, Tim Caswell <[email protected]> wrote: > > If you want this level of static dependencies you can check in your deps > into node_modules in your git tree or use git submodules in there. Git > does guarantee that the thing you point to can't be changed because the > hash *is* the hash of the content. If anything changes, the hash changes. > > > On Wed, Dec 18, 2013 at 7:40 AM, Brian Lalor <[email protected]> wrote: > > On Dec 18, 2013, at 7:23 AM, Richard Marr <[email protected]> wrote: > > I'm working on an app where security is an issue, and among the (many) > things that I'm frothingly paranoid about is the possibility of malicious > (or more likely just untested) code somehow getting into our app, even > though we're using shrink-wrapped versions. It means we'll have to be much > more careful with the way we proxy the npm registry. > > I’d like to know this, as well. One of the guarantees made by the Maven > central repository is that artifacts (packages) can check in, but they can > never check out. I frankly don’t think NPM provides this type of > assurance, but it should. Otherwise the only way an organization can trust > packages is to run their own repository. > > -- > Brian Lalor > [email protected] > > -- > -- > Job Board: http://jobs.nodejs.org/ > Posting guidelines: > https://github.com/joyent/node/wiki/Mailing-List-Posting-Guidelines > You received this message because you are subscribed to the Google > Groups "nodejs" group. > To post to this group, send email to [email protected] > To unsubscribe from this group, send email to > [email protected] > For more options, visit this group at > http://groups.google.com/group/nodejs?hl=en?hl=en > > --- > You received this message because you are subscribed to the Google Groups > "nodejs" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/groups/opt_out. > > > -- > -- > Job Board: http://jobs.nodejs.org/ > Posting guidelines: > https://github.com/joyent/node/wiki/Mailing-List-Posting-Guidelines > You received this message because you are subscribed to the Google > Groups "nodejs" group. > To post to this group, send email to [email protected] > To unsubscribe from this group, send email to > [email protected] > For more options, visit this group at > http://groups.google.com/group/nodejs?hl=en?hl=en > > --- > You received this message because you are subscribed to the Google Groups > "nodejs" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/groups/opt_out. > > > -- > -- > Job Board: http://jobs.nodejs.org/ > Posting guidelines: > https://github.com/joyent/node/wiki/Mailing-List-Posting-Guidelines > You received this message because you are subscribed to the Google > Groups "nodejs" group. > To post to this group, send email to [email protected] > To unsubscribe from this group, send email to > [email protected] > For more options, visit this group at > http://groups.google.com/group/nodejs?hl=en?hl=en > > --- > You received this message because you are subscribed to the Google Groups > "nodejs" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/groups/opt_out. > > > -- > -- > Job Board: http://jobs.nodejs.org/ > Posting guidelines: > https://github.com/joyent/node/wiki/Mailing-List-Posting-Guidelines > You received this message because you are subscribed to the Google > Groups "nodejs" group. > To post to this group, send email to [email protected] > To unsubscribe from this group, send email to > [email protected] > For more options, visit this group at > http://groups.google.com/group/nodejs?hl=en?hl=en > > --- > You received this message because you are subscribed to the Google Groups > "nodejs" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/groups/opt_out. > > > -- > -- > Job Board: http://jobs.nodejs.org/ > Posting guidelines: > https://github.com/joyent/node/wiki/Mailing-List-Posting-Guidelines > You received this message because you are subscribed to the Google > Groups "nodejs" group. > To post to this group, send email to [email protected] > To unsubscribe from this group, send email to > [email protected] > For more options, visit this group at > http://groups.google.com/group/nodejs?hl=en?hl=en > > --- > You received this message because you are subscribed to the Google Groups > "nodejs" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/groups/opt_out. > > > > -- > -- > Job Board: http://jobs.nodejs.org/ > Posting guidelines: > https://github.com/joyent/node/wiki/Mailing-List-Posting-Guidelines > You received this message because you are subscribed to the Google > Groups "nodejs" group. > To post to this group, send email to [email protected] > To unsubscribe from this group, send email to > [email protected] > For more options, visit this group at > http://groups.google.com/group/nodejs?hl=en?hl=en > > --- > You received this message because you are subscribed to the Google Groups > "nodejs" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/groups/opt_out. > > > -- > -- > Job Board: http://jobs.nodejs.org/ > Posting guidelines: > https://github.com/joyent/node/wiki/Mailing-List-Posting-Guidelines > You received this message because you are subscribed to the Google > Groups "nodejs" group. > To post to this group, send email to [email protected] > To unsubscribe from this group, send email to > [email protected] > For more options, visit this group at > http://groups.google.com/group/nodejs?hl=en?hl=en > > --- > You received this message because you are subscribed to the Google Groups > "nodejs" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/groups/opt_out. > > > -- > -- > Job Board: http://jobs.nodejs.org/ > Posting guidelines: > https://github.com/joyent/node/wiki/Mailing-List-Posting-Guidelines > You received this message because you are subscribed to the Google > Groups "nodejs" group. > To post to this group, send email to [email protected] > To unsubscribe from this group, send email to > [email protected] > For more options, visit this group at > http://groups.google.com/group/nodejs?hl=en?hl=en > > --- > You received this message because you are subscribed to the Google Groups > "nodejs" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/groups/opt_out. > -- -- Job Board: http://jobs.nodejs.org/ Posting guidelines: https://github.com/joyent/node/wiki/Mailing-List-Posting-Guidelines You received this message because you are subscribed to the Google Groups "nodejs" group. To post to this group, send email to [email protected] To unsubscribe from this group, send email to [email protected] For more options, visit this group at http://groups.google.com/group/nodejs?hl=en?hl=en --- You received this message because you are subscribed to the Google Groups "nodejs" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/groups/opt_out.
