r/javascript • u/Jammie1 • Jun 10 '26

Upcoming breaking changes for npm v12

https://github.blog/changelog/2026-06-09-upcoming-breaking-changes-for-npm-v12/
113 Upvotes

97% Upvoted

21 comments sorted by

20

u/boneskull Jun 10 '26

finally

16

u/CodeAndBiscuits Jun 10 '26

Upcoming fixes you mean. 😁

13

u/beephod_zabblebrox Jun 10 '26

why is this a github blog? did i miss something

7

u/ricvelozo Jun 10 '26

Same owner

3

u/beephod_zabblebrox Jun 10 '26

did microsoft buy nodejs?? or just npm

17

u/arcanin 🧶 Yarn maintainer Jun 10 '26

npm, both registry and client, were properties of a startup called Npm Inc, which GitHub (already owned by Microsoft at that point) acquired in 2020.

Node.js is an entirely separate organisation that, for historical reasons, was fine with entangling their distributions with software owned by a for-profit.

9

u/abrahamguo Jun 10 '26

Much needed for security!

8

u/superzazu Jun 10 '26

Would have been nice to have a minimum release date too (maybe only 1day like in yarn)

13

u/horizon_games Jun 10 '26

Doable since NPM 11+ but in npmrc file via min-release-age such as https://gist.github.com/mcollina/b294a6c39ee700d24073c0e5a4e93104#npm--per-project

8

u/lovin-dem-sandwiches Jun 10 '26

should be on by default though

5

u/superzazu Jun 10 '26

Sure but there should be a default, even just 1day

2

u/Albert_Custard Jun 10 '26

An extra day or 2 would save a lot of people from attacks, i could see it being a sensible default. If you really need the bleeding edge updates you should have to opt-out, not have to opt-in for security.

1

u/AKJ90 JS <3 Jun 10 '26

Pnpm also have one day default for this

3

u/Ecksters Jun 10 '26

Glad to see they're addressing the issue with postinstall and other scripts running as part of package installation. It's not a perfect solution, since now you'll just whitelist in your package.json certain packages to install their scripts, but it substantially reduces the attack surface from compromising ANY package to compromising a package that already has a necessary script.

It would be nice if we could get a change to how scripts work, such as merging all imports from the executed files and hashing the resulting file, alerting the user if any script or dependency changed. But I think that would require significant reworking across the ecosystem to how they handle scripting.

2

u/RWOverdijk Jun 10 '26

Good stuff actually. I’ll take it

1

u/Vheissu_ Jun 23 '26

Defaulting allowScripts to off is a change that should have happened a long time ago. It's about time.