2021-12-15.md

Meeting from: December 15th, 2021

Open RFC Meeting (npm)

Attendees

• Darcy Clarke (@darcyclarke)
• Matt Hayes (@mysterycommand)
• Owen Buckley (@thescientist13)
• Luke Karrys (@lukekarrys)
• Zbyszek Tenerowicz (@naugtur)

Previously...

• 2021-11-25

Agenda

1. Housekeeping
   1. Introduction(s)
   2. Code of Conduct Acknowledgement
   3. Outline Intentions & Desired Outcomes
   4. Announcements
      • overrides shipped
2. Issue: #497 [RRFC] Warn users when skipping alias/git deps during audit - @rotem-cider
3. Issue: #999 [RRFC] Custom logging location - @EvanCarroll
4. Dsicussion: #496 Mention workspace in run-script output header - @smhg
5. PR: #488 Make npm install scripts opt-in - @tolmasky
6. PR: #481 RFC: Run `prepare` Scripts for Linked Bundled Dependencies - @mysterycommand
7. PR: #375 Define which dependencies are shared among workspace projects - @isaacs

Notes

Issue: #497 [RRFC] Warn users when skipping alias/git deps during audit - @rotem-cider

• @darcyclarke
  • we're planning to revamp npm audit & npm install output to make this issue less relevant
  • explicitely defining which deps get audited & whu will help mitigate confusion

Issue: #999 [RRFC] Custom logging location - @EvanCarroll

• @lukekarrys
  • currently npm owns the cach directory
  • we're looking to separate the logs from the cache/log directory
  • we will only let you determine the directory path & not the file name
  • 👍 to this - is a net-new flag
• @fritzy
  • we should maybe name this appropriately like, --unmanagedLogDir or something similar

Discussion: #496 Mention workspace in run-script output header - @smhg

• ...

• @darcyclarke

  • 👍 for this
  • aligns with the work we'd like to do

• @lukekarrys

  • likes this
  • would have treated this like a bug fix if it didn't come through discussions
  • prefixing is very interesting/compelling as well

• @naugtur

  • can publish --dry-run support this aswell?

• @darcyclarke

  • yes, let's have any workspace-aware command support logging the context

PR: #481 RFC: Run `prepare` Scripts for Linked Bundled Dependencies - @mysterycommand

• @mysterycommand
  • no update
  • was able to get a hacky work around for this
  • only works one level deep

• @fritzy

• @darcyclarke
  • sounds like yarn doesn't support this either
• Actions:
  • @mysterycommand to investigate how yarn handles this
  • @darcyclarke to investigate https://turborepo.org/docs/features/pipelines

PR: #488 Make npm install scripts opt-in - @tolmasky

• @naugtur
  • has done some investigation here
  • worked with maintainer of lavamoat

PR: #375 Define which dependencies are shared among workspace projects - @isaacs

• ...