2020-11-10 feedback triage meeting

[MylesBorins]

Time

UTC Tue 10-Nov-2020 16:00 (04:00 PM):

Timezone	Date/Time
US / Pacific	Tue 10-Nov-2020 08:00 (08:00 AM)
US / Mountain	Tue 10-Nov-2020 09:00 (09:00 AM)
US / Central	Tue 10-Nov-2020 10:00 (10:00 AM)
US / Eastern	Tue 10-Nov-2020 11:00 (11:00 AM)
EU / Western	Tue 10-Nov-2020 16:00 (04:00 PM)
EU / Central	Tue 10-Nov-2020 17:00 (05:00 PM)
EU / Eastern	Tue 10-Nov-2020 18:00 (06:00 PM)
Moscow	Tue 10-Nov-2020 19:00 (07:00 PM)
Chennai	Tue 10-Nov-2020 21:30 (09:30 PM)
Hangzhou	Tue 11-Nov-2020 00:00 (12:00 AM)
Tokyo	Wed 11-Nov-2020 00:00 (12:00 AM)
Sydney	Wed 11-Nov-2020 02:00 (02:00 AM)

or in your local time:

• https://www.timeanddate.com/worldclock/fixedtime.html?msg=npm+live+feedback+triage+meeting+2020-10-27&iso=20201109T1600

Agenda

Hand compiled by @MylesBorins

Package meta data review

Last meeting we spent the majority of time discussing Package Meta Data. Let's do a quick recap of what our plans our for work in this area.

Improvements to 2FA + publishing + tokens

Last quarter we launched npm automation tokens. We've received great feedback about ways that we can improve them. Let's discuss what we could prioritize next.

• Naming npm tokens
• Feedback on CI-specific auth codes
• 2FA makes publishing from continuous deployment difficult

npm's role as a registry steward

While we do have a current policy for claiming abandoned packages it seems folks are having a
hard time finding this information. Further it might be time to consider a refresh of policy.

Let's discuss.

• What happens to abandoned packages?
• Audit and/or validate certain "unique" details of package.json
• Packages that name-squat on built-in module names

Login + Auth

Currently authenticating with multi-registries can be difficult and there isn't a clear path
for support SSO. Let's discuss what the future of authentication could look like and how we
could deeper integrate GitHub + npm accounts

• Support for Browser-Based Auth from CLIs
• Login with GitHub

Frustration with CVEs and audit

There has been awesome feedback in the ecosystem related to CVE reporting as well as dark patterns we are seeing in the ecosystem that create additional work for maintainers. Let's discuss the open discussion and see if we have ideas for next steps.

• Reduce the noise, work, and frustration from CVE reporting

Additional Topics

We may not have time for the below discussion topics in this week's meeting. If we get through the above topics we will do a quick review of the below topics and pick the ones we want to prioritize discussion around.

Meta

• Specify the registry for a module

Registry

• Document the registry endpoints
• npm publish finishes before publish is done
• Precompiled Binary Hosting
• Batch metadata

CLI

• Workspaces in the npm CLI
• Make it easier to install a package from a pull request
• Add npm scripts as first level commands - npm dev
• Support for groups of dependencies (beyond just prod/dev)
• make engines field usable with postinstall scripts
• Lockfile interop between npm6 and 7
• Why is onload-script no longer supported?
• Fixing package-lock protocol jitter

Website

• Add sorts to various random package views
• Remove 'npm is now part of GitHub' from npmjs.com

Public Participation

We stream our conference call straight to YouTube so anyone can listen to it live, it should start playing at https://www.youtube.com/c/npminc/live when we turn it on. There's usually a short cat-herding time at the start of the meeting and then occasionally we have some quick private business to attend to before we can start recording & streaming. So be patient and it should show up.

If you have specific questions you would like us to answer that are outside of the planned agenda please start a discussion thread in this

[MylesBorins]

Hey All,

We are live in 1.5 hours!

[MylesBorins]

Was a great meeting, recording is at https://www.youtube.com/watch?v=aBCTSPIe8hE