---
# System prepended metadata

title: Open RFC Meeting (npm)

---

#### Meeting from: September 1st, 2021

# Open RFC Meeting (npm)

### Attendees
- Darcy Clarke (@darcyclarke)
- Gar (@wraithgar)
- Vincent Bailly (@VincentBailly)
- Isaac Z. Schlueter (@isaacs)
- Nathan Fritz (@fritzy)
- Owen Buckley (@)
- Nathan LaFreniere (@nlf)

### Previously...

- [2021-08-25](https://github.com/npm/rfcs/blob/latest/meetings/2021-08-25.md)

### Agenda

1. **Housekeeping**
	1. Introduction(s)
	1. [Code of Conduct Acknowledgement](https://www.npmjs.com/policies/conduct)
	1. Outline Intentions & Desired Outcomes
	1. Announcements
1. **`npm` v8 Plan:** https://github.com/npm/rfcs/issues/445 ~ @nlf
1. **PR**: [#441 addendum: overrides apply if value matches, as well as key](https://github.com/npm/rfcs/pull/441) - @isaacs
1. **PR**: [#437 RFC: Robust Lifecycle Scripts](https://github.com/npm/rfcs/pull/437) - @fritzy
1. **PR**: [#436 new installation mode: pure-mode](https://github.com/npm/rfcs/pull/436) - @VincentBailly
1. **PR**: [#422 RFC: audit assertions](https://github.com/npm/rfcs/pull/422) - @bnb
1. **PR**: [#126 RFC: Adding types information to the Package JSON in the  registry](https://github.com/npm/rfcs/pull/126) - @orta

### Notes

#### **`npm` v8 Plan:** https://github.com/npm/rfcs/issues/445 ~ @nlf
- @nlf 
  - want to set ourselves up for success in the future
  - `npm@8` should drop support for `node@10`
  - `npm@7` had a number of issues when consumers upgraded
  - `npm@8` should refuse to install a version of itself that is not compatible with the current `node` version for end-users
- @ljharb 
  - "What about the 'stricter peer deps' change becoming default?"
- @nlf
  - we want to keep the number or breaking changes to a limited set
- @isaacs 
  - the "refuse to install a breaking version of the CLI" is a `npm@7` change we'll make to help with migration to `npm@8`
  - in terms of 'stricter peer deps' as 
- @wraithgar
  - the less that breaks, the more likely we are to land this version of `npm` into `node@8` 

#### **PR**: [#441 addendum: overrides apply if value matches, as well as key](https://github.com/npm/rfcs/pull/441) - @isaacs
- @isaacs 
  - we need to keep track of overriden nodes in the tree somehow
  - making this ammendment ensures that string or dot members can match on current node so that we can apply override nodes properly
  - there are some implications
- **Actions:**
  - [ ] @isaacs to pull in changes to spec

#### **PR**: [#437 RFC: Robust Lifecycle Scripts](https://github.com/npm/rfcs/pull/437) - @fritzy
- @fritzy
  - no updates from last week
- **Actions:**
  - [ ] @fritzy to flush out the rest of the RFC sections

#### **PR**: [#436 new installation mode: pure-mode](https://github.com/npm/rfcs/pull/436) - @VincentBailly
- @VincentBailly
  - based on last week's meeting notes/action items:
    - On SemVer: There isn't a need to make this a major version bump as it is an opt-in feature - it can wait to be introduced in a major if we _want_ to
    - On Breaking Changes: Packages that rely on the hoisting behavior for shadow dependencies, usually accidentally.
    - Examples of Broken Projects: Packages that do static analysis, Amazon Web Services & React Native projects do not support symlinks & would be broken by a strict-mode/symlinked mode
  - the examples of broken projects does not feel scary, personally, & is following a paved-path by other package managers (ex. `pnpm` & `yarn`)
- @isaacs 
  - had a sync w/ @fritzy & @vincentbailly
  - potential for lockfile & node_modules folder to not be accurate based on the initial implementation strategy we've discussed to transmute the tree between modes
  - that said, the hidden lockfile should always be accurate
  - there is a spearate conversation happening about the sharing of deps in a separate issue (#375)
- @vincentbailly
  - there was a question about whether or not this pertains to just Workspace projects or to all projects
  - the answer to this is that this RFC, & corresponding work, should apply to **all** projects
  - seems to be some confusion in the vocabulary
- **Actions:**
  - [ ] @vincentbailly will reframe the RFC to be more clear & direct people to #375 (ie. focus on motivation)
  - [ ] @vincentbailly will come up with options for a new name, as "Pure Mode" isn't well recieved by everyone (potentially run a poll using emojis)
  - [ ] @vincentbailly to review RFC to ensure it is clear that this mode applies to **all** `npm` projects

#### **PR**: [#422 RFC: audit assertions](https://github.com/npm/rfcs/pull/422) - @bnb
- @bnb
  - updated the RFC based on the last set of action items
  - there is some discussion around trust sources
  - not sure how important that feedback is to consider
- @darcyclarke
  - has @asciimike jumped in & been able to help at all?
- @bnb
  - yes
- **Actions:**
  - [ ] @darcyclarke to add comments/feedback about API design (ie. `npm audit assert --module=<package spec>` vs. `npm audit asser <package spec>`)

#### **PR**: [#126 RFC: Adding types information to the Package JSON in the  registry](https://github.com/npm/rfcs/pull/126) - @orta
- @wraithgar 
  - no evaulation of `flow`, no one has asked for this
  - dropped `flow` 
- **Actions:** 
  - [ ] @wraithgar to pull in [PR #103, adding `types` field to `read-package-json`](https://github.com/npm/read-package-json/pull/103) - future publishes will now have that metadata included
