6 ms·
Github / Microsoft could easily fix this, couldn't they? Leaving NPM up in its current state seems criminal, especially since LLMs generate NPM commands so freq
by afpx 3mo ago
Github / Microsoft could easily fix this, couldn't they? Leaving NPM up in its current state seems criminal, especially since LLMs generate NPM commands so frequently.
- jjice 3mo agoThey have some changes here in v12: https://github.blog/changelog/2026-06-09-upcoming-breaking-changes-for-npm-v12/ https://github.blog/changelog/2026-06-09-upcoming-breaking-c...
- WalterGR 3mo agoAnd the discussion here, with 215 comments: https://news.ycombinator.com/item?id=48467705 https://news.ycombinator.com/item?id=48467705
- deleted 3mo ago[deleted]
- sheept 3mo agoIs it possible to fix it in a backwards compatible way? Removing lifecycle scripts is at least a semver major change, and would complicate existing projects relying on packages with lifecycle scripts from upgrading.
- evilduck 3mo agoThis is a real world trolley problem scenario. You can break workflows or you can let everyone get pwned by supply chain attacks. Which is the greater harm?
- sheept 3mo agoPeople will not adopt a safer version if it broke their workflows. Adoption is part of preventing supply chain attacks.
- idiotsecant 3mo agoThey will if it's the only version. Eventually.
- evilduck 3mo agoSure they will. When the real or perceived cost of addressing supply chain attacks exceeds the cost of changing tooling workflows, they will switch.
- deleted 3mo ago[deleted]