---
# System prepended metadata

title: Open RFC Meeting (npm)

---

#### Meeting from: June 23rd, 2021

# Open RFC Meeting (npm)

### Attendees
- Darcy Clarke (@darcyclarke)
- Wes Todd (@wesleytodd)
- Isaac Z. Schlueter (@isaacs)
- Ruy Adorno (@ruyadorno)
- Nathan LaFreniere (@nlf)
- Gar (@wraithgar)
- Rebecca Turner (@iarna)
- Jordan Harband (@ljharb)

### Agenda

1. **Housekeeping**
	1. Introduction(s)
	1. [Code of Conduct Acknowledgement](https://www.npmjs.com/policies/conduct)
	1. Outline Intentions & Desired Outcomes
	1. Announcements
1. **PR**: [#3456 feat: add prefix for version output](https://github.com/npm/cli/pull/3456) - @cyntler
1. **PR**: [#3437 fix(ls/search) --json arg error also sent to stdout](https://github.com/npm/cli/pull/3437) - @RammasEchor
1. **Issue**: [#398 [RRFC] Top-level command to manage package.json](https://github.com/npm/rfcs/issues/398) - @ruyadorno
1. **PR**: [#3397 feat(config): add in-range](https://github.com/npm/cli/pull/3397) - @wraithgar
1. **PR**: [#392 RFC: group outdated packages by dependency type](https://github.com/npm/rfcs/pull/392) - @thiagodp
1. **Issue**: [#390 [RRFC] npm publish should fail when the &#x60;files&#x60; is misconfig in package.json](https://github.com/npm/rfcs/issues/390) - @aladdin-add
1. **PR**: [#343 RFC: npm workspaces: auto switch context based on cwd](https://github.com/npm/rfcs/pull/343) - @ruyadorno
1. **PR**: [#319 feat(multiple-dist-tags): add proposal for multiple dist-tags](https://github.com/npm/rfcs/pull/319) - @wraithgar
1. **PR**: [#273 RFC: npm workspaces - Config management](https://github.com/npm/rfcs/pull/273) - @ruyadorno
1. **PR**: [#182 RFC: npm audit licenses](https://github.com/npm/rfcs/pull/182) - @bnb

### Notes

#### **PR**: [#3456 feat: add prefix for version output](https://github.com/npm/cli/pull/3456) - @cyntler
  - @wraithgar this is a breaking change

#### **PR**: [#3437 fix(ls/search) --json arg error also sent to stdout](https://github.com/npm/cli/pull/3437) - @RammasEchor
  - @wesleytodd
    - there's errors you won't be able to handle & can't expect `--json` to catch that
  - @iarna 
    - wouldn't expect STDERR to be JSON 
  - @ljharb
    - would only expect a successful request to output JSON
  - @bnb would like to set this  

#### **Issue**: [#398 [RRFC] Top-level command to manage package.json](https://github.com/npm/rfcs/issues/398) - @ruyadorno
  - @ruyadorno
    - Created RFC: https://github.com/npm/rfcs/pull/402
    - Updated/refactored internal code to use net-new `@npmcli/package-json`
  - @wesleytodd 
    - nice to be able to format the value w/ a similar syntax to the key
  - @isaacs 
    - should define how we map to keys with dots & make that consistent across `npm config` (getters/setters should work the same in `npm pkg`)
    - possibly providing a way to escape strings with a dot: `npm pkg set foo["1.2.3"]=bar`
  - @nlf 
    - npm pkg set tap.timeout=60 means take the tap object and change timeout to 60 within it
    - npm pkg set tap={"timeout":60} means replace the entire tap object with the given value
  - @ljharb `config` should have dot config deprecated/will be a breaking change
  - @wraithgar we can start warning if we see dot config keys so we can eventually remove in next major

#### **PR**: [#3397 feat(config): add in-range](https://github.com/npm/cli/pull/3397) - @wraithgar
  - @wraithgar 
    - `npm outdated` isn't that helpful - color isn't very telling
    - @isaacs suggested adding `--dry-run` support to `npm updae
  - @ljharb 
    - seems like theres two use cases here...
    - 1. show me all the things that aren't at the latest version
    - 2. show me what would be/should be updated if I ran `npm update`
  - @isaacs 
    - we should be printing the diff from reify when passed `--dry-run`
  - @iarna out-of-range updates implies not reporting on transitive dependencies too, which nicely simplifies the output you have to have

#### **PR**: [#392 RFC: group outdated packages by dependency type](https://github.com/npm/rfcs/pull/392) - @thiagodp
  - @isaacs: sort by "first dep type a given name is found in", and then by "name"
  - @wraithgar: just need to be clear about the priority ordering


#### **Issue**: [#390 [RRFC] npm publish should fail when the &#x60;files&#x60; is misconfig in package.json](https://github.com/npm/rfcs/issues/390) - @aladdin-add
  - @isaacs Implementation is more complex than it seems due to the nature of globs patterns and the interaction between multiple defined patterns from different places `.gitignore`, `.npmignore` and `files` package.json property
  - @ljharb it would be extremely helpful to warn & eventually error
  - @isaacs
      - could potentially do this if the rule is "every non-negated entry in `"files"` must match 1 or more filesystem entries"
      - would treat `{a,b}` as a "pass, no warn" if `a` is found and `b` isn't.  Warn if any non-negated entry in `files` does not have 1 or more matches, and `{a,b}` had a match if `a` is found and `b` isn't.
      - `"files": ["lib"]` if `lib/` exists, but is empty, we won't actually put anything in the package, but the pattern had a match, so no warning.
      - What if you have `"files": ["lib/*.js", "!lib/foo.js"]` and the only file in `lib/` is `lib/foo.js`?  The first entry had a match, but then it was negated out.
      - This sounds simple, but it is deceptively complicated.
  - @wraithgar feels like we're continuing to circle the drain on guessing user intent; There are other mechanisms for this like prepare/prepublish lifecycle events
  - @nlf very much agreed. if you want to assert that your files array is right, that's up to you. having that templated is useful and i'd be somewhat annoyed if my template started throwing errors because i haven't created a bin directory in my repo
      - @isaacs `^` THIS

#### **PR**: [#343 RFC: npm workspaces: auto switch context based on cwd](https://github.com/npm/rfcs/pull/343) - @ruyadorno
  - @ruyadorno no updates

#### **PR**: [#319 feat(multiple-dist-tags): add proposal for multiple dist-tags](https://github.com/npm/rfcs/pull/319) - @wraithgar
  - @wraithgar no updates

#### **PR**: [#273 RFC: npm workspaces - Config management](https://github.com/npm/rfcs/pull/273) - @ruyadorno
  - @ruyadorno no updates

#### **PR**: [#182 RFC: npm audit licenses](https://github.com/npm/rfcs/pull/182) - @bnb
  - @bnb 
    - got initial work done to open a PR (ref. https://github.com/npm/cli/pull/3452) - barebones