Yarn

Yarn

@yarnpkg.dev

Fast, reliable, and secure package management. Account managed by @mael.dev

1.2K followers33 following15 posts

Yarn
@yarnpkg.dev

We just released the 4.15 branch 馃帄 One important change is that npmMinimalAgeGate will now default to 1d for new projects.

Yarn
@yarnpkg.dev

Reminder that Yarn lets you filter out fresh packages with `npmMinimalAgeGate` and it's a good idea to use it on your work repos!

Yarn
@yarnpkg.dev

Unfortunately it can't help people that happen to create new projects right when the vulnerability is up, since they rarely configure that in their home folder. And making it a default could impair security fixes (for instance the Next.js/React CVEs).

Yarn
@yarnpkg.dev

The right fixes would likely be for the npm registry to *finally* add support for 2FA publishing in a way compatible with both automations and monorepos. They announced some interest couple of months ago, but it hasn't transformed so far.

Yarn
@yarnpkg.dev

We just released the 4.14 branch! 馃帄 Two important security changes: - `enableScripts` now defaults to `false` (can be overridden on a per-package basis) - A new `approvedGitRepositories` setting should be used to tell Yarn which git repos are safe to pack.

Yarn
@yarnpkg.dev

Neither of those are breaking: if you migrate from an older version Yarn will automatically update your `.yarnrc.yml` to explicitly apply the old default settings, which you can remove whenever you're ready. New projects on the other hand will immediately benefit from these changes.

Yarn reposted

Gautier
@gautier.dev

Breaking news: @yarnpkg.dev 4.9.0 was just released with `yarn npm publish --provenance` and `yarn add jsr:package` support. Update your CIs and brag to your friends about your shiny provenance badges!

Yarn reposted

Paris TypeScript
@typescript.paris

馃嚞馃嚙 Hello TypeScripters 馃憢 Meet @mael.dev, the brilliant mind behind @yarnpkg.dev, the popular JavaScript package manager! A passionate open-source contributor, Ma毛l has been transforming the way developers manage dependencies, making their workflow faster and more efficient.

Yarn
@yarnpkg.dev

We're considering it as well.

pnpm@pnpm.io

pnpm can block lifecycle scripts of dependencies during installation. This is an opt-in feature though. Should we block them by default? github.com/orgs/pnpm/di...

github.comShould we block lifecycle script of dependencies during installation? 路 pnpm 路 Discussion #8918There was recently an incident with rspack, where it was published with a postinstall script that contained malware. Such incidents happen from time to time, so it could be a good idea to stop runn...

You are up to date.