[RRFC] Allow list of registries (to be used as a per-project .npmrc override)
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 777
- Forks
- 267
- PR merge metrics
- No merged PRs in 30d
Description
Motivation ("The Why")
I found some references to private registries in a package-lock.json of a public project. They likely ended up in there by mistake.
Sorry, if there's already an existing feature that I missed that can solved this...
Example
How
Current Behaviour
The package-lock.json / package.json will be installed based on user's .npmrc.
Desired Behaviour
A project should be able to create an explicit allow list of registries in its own .npmrc.
This would also likely be useful for users as well, just in case a project does not define an allow list, and installs from other registries than the user's preferred one.
I realize that there may be some collisions there between user settings and project settings, so there may be a degradation of UX there...
References
- n/a
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing the current interaction between project .npmrc files, user settings, package.json, and package-lock.json, along with the referenced kubernetes-client/javascript pull request. Clarify how an explicit registry allow list should interact with user preferences and installs from other registries. Done would require an agreed proposal for the behavior, including the noted configuration collisions.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- cli
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100