Add CLI flags for package release version dates
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 10.1k
- Forks
- 4.7k
- Avg merge
- 2d 2h
- Merged PRs (30d)
- 19
Description
Would it be possible to consider an RFC for adding flags to npm CLI to specify dates from/until which any dependency or sub dependencies should be installed from?
e.g npm i --until 20250908
It can stderr if semver is not matching a major or minor release. This could also be a strict level flag.
e.g. npm i --until 20250908 --preserve major
The motivation is to enable organizations to respond to supply-chain security incidents faster, and with greater certainty.
e.g
https://snyk.io/blog/sha1-hulud-npm-supply-chain-incident/
Thank you.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
The issue names no files or tests; begin by reviewing npm CLI's install command and its existing dependency-version handling. Clarify the date-range, semver, and strictness semantics with maintainers before proposing the RFC. Done means the requested flags and their behavior are specified and agreed.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, node.js
- Domain
- cli, security, tooling
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 30/100