Node.js Package Maintenance...
summary
A three‑year working group documents best practices and builds concrete tools: a pkg.js support spec and validator that encodes supported Node versions and response SLAs, an experimental Webby that opens CI pull requests into dependents to detect breakage, and a spun‑off package vulnerability collaboration space to streamline CVE reporting. The registry now hosts about 1.6 million packages with >100 billion monthly downloads and a median of 683 transitive deps, so these tools aim to reduce surprise breakage and noisy security churn.
AI-written summary · about
chapters (18)
- 0:00Introduction to team
- 1:03Panelist introductions
- 4:00History of package maintenance
- 6:33Ecosystem health perspectives
- 8:44Enterprise needs and gaps
- 10:30Choosing reliable modules
- 11:54npm registry growth
- 15:04Commercial dependency realities
- 18:16Team's early work
- 20:43Handling unmaintained modules
- 21:25Package support specification
- 23:12User expectations vs reality
- 26:08Introducing Wibby tool
- 29:18Vulnerability management
- 32:48Greatest team achievements
- 34:11Getting involved in open source
- 35:40Call to community participation
- 36:26Closing remarks
related talks
30mHappy Developers, Healthy Modules - Together We Can Do This
45mNext Gen Package Management
23mCover Your Apps While Still Using npm
30mWhat's Really Going on Inside Your Node_Modules Folder
19mConsuming Open-source: A maintainer's perspective
31mnpm: paster, presenter, futurer
47mBlack Clouds and Silver Linings in Node.js Security
53mnpm vulnerabilities: the call is accepted