microsoft / microsoft/DefinitelyTyped-tools

Previously published npm packages are being overwritten by the publish tool

Open
#339 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
TypeScript
Stars
423
Forks
237
Avg merge
18h 18m
Merged PRs (30d)
11

Description

The publish tool should not be overwriting previously published packages.
https://docs.npmjs.com/policies/unpublish
Overwriting published packages is against npm's policy, and I'm not sure how this was even possible because the npm registry should be immutable.

Our stable CI pipeline has failed to build since this PR was merged
https://github.com/DefinitelyTyped/DefinitelyTyped/commit/5f1a94967148173f78ff00792c29ef5f2a1a3edb

We are using @types/react-redux 7.1.16. That npm package was originally published 9 months ago, but overwritten 6 days ago.
https://www.npmjs.com/package/@types/react-redux/v/7.1.16

I started looking into some of the other packages that would have been affected by that same PR.
https://www.npmjs.com/package/@types/chai-enzyme/v/0.6.7
https://www.npmjs.com/package/@types/emoji-mart/v/3.0.4
https://www.npmjs.com/package/@types/enzyme/v/3.10.8

All @types packages affected by the above PR have their previously published npm packages overwritten 6 days ago.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reviewing the publish tool and the referenced commit 5f1a94967148173f78ff00792c29ef5f2a1a3edb, then compare the affected package versions listed in the issue. Reproduce the stable CI failure if possible; done means previously published packages are not overwritten and the stable pipeline builds successfully.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
release
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.