2020-11-27 feedback triage meeting

[MylesBorins]

Time

UTC Tue 24-Nov-2020 15:00 (03:00 PM):

Timezone	Date/Time
US / Pacific	Tue 24-Nov-2020 07:00 (07:00 AM)
US / Mountain	Tue 24-Nov-2020 08:00 (08:00 AM)
US / Central	Tue 24-Nov-2020 09:00 (09:00 AM)
US / Eastern	Tue 24-Nov-2020 10:00 (10:00 AM)
EU / Western	Tue 24-Nov-2020 15:00 (03:00 PM)
EU / Central	Tue 24-Nov-2020 16:00 (04:00 PM)
EU / Eastern	Tue 24-Nov-2020 17:00 (05:00 PM)
Moscow	Tue 24-Nov-2020 18:00 (06:00 PM)
Chennai	Tue 24-Nov-2020 20:30 (08:30 PM)
Hangzhou	Tue 24-Nov-2020 23:00 (11:00 PM)
Tokyo	Wed 25-Nov-2020 00:00 (12:00 AM)
Sydney	Wed 25-Nov-2020 02:00 (02:00 AM)

or in your local time:

• https://www.timeanddate.com/worldclock/fixedtime.html?msg=npm+live+feedback+triage+meeting+2020-11-24&iso=20201124T1300

Agenda

Hand compiled by @MylesBorins

Package meta data review

A review of where we are at on package MetaData work and some other related discussions opened.

• Add sorts to various random package views
• identify/label library forks and score/sort them accordingly

Improvements to 2FA + publishing + tokens

An update on progress with automation tokens. One new request.

• Organization/Team Tokens

npm's role as a registry steward

• Audit and/or validate certain "unique" details of package.json
• Standardization of a entrypoints in package.json for other languages.

Login + Auth

Review of planning for deeper integration between GitHub + npm authentication.

• Support for Browser-Based Auth from CLIs

Additional Topics

We may not have time for the below discussion topics in this week's meeting. If we get through the above topics we will do a quick review of the below topics and pick the ones we want to prioritize discussion around.

Meta

• Specify the registry for a module
• Reduce the noise, work, and frustration from CVE reporting

Registry

• Document the registry endpoints
• npm publish finishes before publish is done
• Precompiled Binary Hosting
• Batch metadata
• Audit and/or validate certain "unique" details of package.json

CLI

• Make it easier to install a package from a pull request
• Add npm scripts as first level commands - npm dev
• Support for groups of dependencies (beyond just prod/dev)
• make engines field usable with postinstall scripts
• Lockfile interop between npm6 and 7
• Fixing package-lock protocol jitter
• shallow clone of git dependencies

Website

• Add GitHub icon to site

Public Participation

We stream our conference call straight to YouTube so anyone can listen to it live, it should start playing at https://www.youtube.com/c/npminc/live when we turn it on. There's usually a short cat-herding time at the start of the meeting and then occasionally we have some quick private business to attend to before we can start recording & streaming. So be patient and it should show up.

If you have specific questions you would like us to answer that are outside of the planned agenda please start a discussion thread in this

[MylesBorins]

Great meeting y'all

You can find the video at https://www.youtube.com/watch?v=CfVvH3Atskc