---
# System prepended metadata

title: Open RFC Meeting (npm)

---

#### Meeting from: June 16th, 2021

# Open RFC Meeting (npm)

### Attendees
- Darcy Clarke (@darcyclarke)
- Gar (@wraithgar)
- Daniel Park (@gimli01)
- Isaac Z. Schlueter (@isaacs)
- Ruy Adorno (@ruyadorno)
- Luke Karrys (@lukekarrys)
- Nathan LaFreniere (@nlf)
- Jordan Harband (@ljharb)

### Agenda

1. **Housekeeping**
	1. Introduction(s)
	1. [Code of Conduct Acknowledgement](https://www.npmjs.com/policies/conduct)
	1. Outline Intentions & Desired Outcomes
	1. Announcements
1. **Clean up of [historically ratified RFCs](https://github.com/npm/rfcs/tree/latest/accepted)**
    - Determine what items should be moved to `withdrawn` & the corresponding [amendment](https://github.com/npm/rfcs/blob/latest/withdrawn/0000-template.md)
1. **Check-in / Progress on Action Items**
    - Quick updates on &/or additions to tracking work items
1. **Issue**: [#398 [RRFC] Top-level command to manage package.json](https://github.com/npm/rfcs/issues/398) - @ruyadorno
1. **Issue**: [#390 [RRFC] npm publish should fail when the files is misconfig in package.json](https://github.com/npm/rfcs/issues/390)
1. **PR**: [#343 RFC: npm workspaces: auto switch context based on cwd](https://github.com/npm/rfcs/pull/343) - @ruyadorno
1. **PR**: [#336 RFC for &#x60;where&#x60; config parameter](https://github.com/npm/rfcs/pull/336) - @nlf
1. **PR**: [#392 RFC: group outdated packages by dependency type ](https://github.com/npm/rfcs/pull/392) - @thiagodp 
1. **PR**: [#386 RFC: Add check-installed-peers](https://github.com/npm/rfcs/pull/386) - @roaders
1. **PR**: [#3397 - feat(config): add `in-range` to `npm outdated`](https://github.com/npm/cli/pull/3397)

## Tracking Work / Action Items

#### **Issue**: [#395 [RRFC] Promote &#x60;npm add&#x60; to a top-level command](https://github.com/npm/rfcs/issues/395)
- [ ] @ruyadorno to turn this into an actual RFC

#### **Issue**: [#371 [RRFC] `npm-audit-resolver` next-steps](https://github.com/npm/rfcs/issues/372)
- [ ] @naugtur to make a PR (or issue) against arborist's audit report to indicate direct dependencies in output
- [ ] @naugtur to investigate npm explain --json as means to figure out if a vulnerable path is a dev/optional/bundled dependency
- [ ] @naugtur to create an issue against the CLI to to show the diff information that Arborist provides (@isaacs: should probably always show if --dry-run)

#### **PR**: [#182 RFC: npm audit licenses](https://github.com/npm/rfcs/pull/182)
- [ ] @ruyadorno & @bnb to sync & work on initial work / POC

### Notes

#### **Clean up of [historically ratified RFCs](https://github.com/npm/rfcs/tree/latest/accepted)**
  - Determine what items should be moved to `withdrawn` & the corresponding [amendment](https://github.com/npm/rfcs/blob/latest/withdrawn/0000-template.md)
  - Leaving proposals in the `accepted/` folder means it's somehow in our roadmap and the community might expect these to be impelemented at some point, thus removing things we're not likely to prioritize makes more sense than just leaving it all sit there forever.
  - 0002-changelog
      - not likely to implement
      - adding a new command to a domain outside that of the npm cli responsability
  - 0004-npm-audit-xml-report
      - not likely to implement
      - @ljharb maybe useful distinction to make "patch welcome"
          - @isaacs: we can just put that in the withdraw note
  - 0005-update-package-json
      - implemented by default in arborist now, seems like?
      - needs review to see if it differs from implementation
  - 0006-shallow-updates
      - implemented by default when doing `npm update <name>`, irrelevant when doing `npm update` (noargs) because that just rebuilds the tree from scratch ignoring the lockfile.
      - needs to be reviewed, looks like parts of it were implemented so it might need tweaking/updating
  - 0007-publish-without-tag
      - will implement, keep as accepted
  - 0008-no-caret-prerelease-installs
      - @isaacs: push back, not particularly useful, kind of changes established semantics of semver and how prereleases are handled.
      - users can use `save-exact` if that's what they wanted
  - 0011-npm-link-changes
      - That particular implementation no longer exists, links are handled differently by arborist now
  - 0012-running-as-root
      - needs review to see if it differs from implementation
      - looks like it was already updated to use the owner-inference thing
  - 0028-publish-prompt
      - keep
  - 0034-improve-command-suggestions
      - implemented
  - 0035-registry-spec
      - keep
  - 0036-overrides
      - keep
  - 0037-audit-overrides
      - keep


#### **Check-in / Progress on Action Items**
  - Quick updates on &/or additions to tracking work items
  - Nothing to update this week - will keep tracking these for next week

#### **Issue**: [#398 [RRFC] Top-level command to manage package.json](https://github.com/npm/rfcs/issues/398) - @ruyadorno
  - @ruyadorno
    - want to standardize/centralize this process
    - implemented `set-script` but that was a one-off
    - something like this makes it easier to manage workspaces
  - @isaacs suggested API should match `npm config`
  - @darcyclarke `npm view` works this way as well 
  - @isaacs what does `npm pkg -w <ws-name> set ...` does?
  - @darcyclarke should def be a supported workflow
  - @ljharb could provide great automation workflows for setting fields across multiple packages
  - Actiom item: Write an actual RFC


#### *Issue*: [#390 [RRFC] npm publish should fail when the files is misconfig in package.json](https://github.com/npm/rfcs/issues/390)
  - @ljharb if an item is explicitly included, it makes sense to throw in case it's missing
  - @isaacs it's a breaking change if it's an error. should be a warning by default.
  - @darcy could opt-in to erroring with a `--files-strict` config
  - Action item: Backlog an item to start logging the warning message
  - @isaacs: example:
      ```
      // ok if we ONLY have lib/foo/bar.xyz, but nothing else?
      lib/{?.js,*,foo/**/*.xyz,baz}
      ```
  - simplest approach would be something like "every pattern in `files` must match at least one path in the packlist", rather than treating `{,}` expansion in any special  way

#### **PR**: [#343 RFC: npm workspaces: auto switch context based on cwd](https://github.com/npm/rfcs/pull/343) - @ruyadorno
  - @ruyadorno
    - one suggestion, throw a warning would make sense
  - options:
      - walk up the tree (NOOOOOOO)
      - config in workspace or elsewhere `--workspace-root=<path>`
        - could put in `packages/a/.npmrc`, but an invitation to footguns, because we don't copy npmrc from workspace root?
      - config in packages/foo/package.json indicating workspace root (kind of an odd fit)
      - link in `packages/foo/node_modules/.npm/workspace-root` to workspace root on first reify
      - put the `packages/foo/.npmrc` file there with `workspace-root` on first reify
      - put it in `packages/foo/package-lock.json` containing _only_ the `workspaceRoot` property
  - @isaacs: need a decision on intended behavior
      - is the setting of workspace-root something that should happen implicitly?
      - should it be leaked in published packages?
      - only happen on `init`?  or on any reification?
  - Action item: Let's clean up the RFC and go with the nested `.npmrc` alternative for now, then we can continue/expand the conversation on this specific solution

#### **PR**: [#336 RFC for &#x60;where&#x60; config parameter](https://github.com/npm/rfcs/pull/336) - @nlf
  - recommendation:
      - `--package-location` for `npm exec`
      - `--config-location` for `npm config`
      - should be enum words, not paths

#### **PR**: [#392 RFC: group outdated packages by dependency type ](https://github.com/npm/rfcs/pull/392) - @thiagodp 

#### **PR**: [#386 RFC: Add check-installed-peers](https://github.com/npm/rfcs/pull/386) - @roaders
  - ...

#### **PR**: [#3397 - feat(config): add `in-range` to `npm outdated`](https://github.com/npm/cli/pull/3397)
  - ...