#### Meeting from: Wednesday, June 15, 2022

# Open RFC Meeting (npm)

### Attendees
- Nathan Fritz (@fritzy)
- Jon Jensen (@jenseng)
- Luke Karrys (@lukekarrys)
- Owen Buckley (@thescientist13)
- Gar (@wraithgar)
- Evan Hahn (@EvanHahn)
- Wes Todd (@wesleytodd)
-
-
-

### Agenda
1. **Housekeeping**
1. Introduction(s) (ex. note the name of the call, state the week day & date)
1. [Code of Conduct Acknowledgement](https://www.npmjs.com/policies/conduct)
1. Outline Intentions & Desired Outcomes (ex. want to interact with the community to ensure that there is movement on important issues/ideas for the project)
1. Announcements
1. **Issue**: [#519 BREAKING CHANGE(engines): engines support for npm9](https://github.com/npm/statusboard/issues/519) - @lukekarrys
1. **PR**: [#5000 feat: add npm query cmd](https://github.com/npm/cli/pull/5000) - @ruyadorno
1. **PR**: [#595 Propose backwards-compatible improvements to compression](https://github.com/npm/rfcs/pull/595) - @EvanHahn
1. **PR**: [#593 Only Registry Tarballs](https://github.com/npm/rfcs/pull/593) - @thescientist13
1. **PR**: [#591 RFC: Registry-scoped keyfile / certfile credential options](https://github.com/npm/rfcs/pull/591) - @jenseng
1. **PR**: [#165 RFC for parent package.json](https://github.com/npm/rfcs/pull/165) - @Christian24
3. **Issue**: [#489 Initiative: `v8.x`](https://github.com/npm/statusboard/issues/489) - @darcyclarke
4. **Issue**: [#487 Initiative: `v10.x`](https://github.com/npm/statusboard/issues/487) - @darcyclarke
5. **PR**: [#564 RFC: Dependency Selector Syntax & `npm query`](https://github.com/npm/rfcs/pull/564) - @darcyclarke
6. **Issue**: [#443 Initiative: `v9.x`](https://github.com/npm/statusboard/issues/443) - @darcyclarke

### Notes

1. Enginges support for npm9
- Gar: One issue is conflating support and compatability so we are looking to unwind that
- Wes had a markdown file for a spec about this. npm can hopefully adhere to or contribute to this spec
- Action item @lukekarrys: define support in a SUPPORT.md document in all of our repos
- Action item @lukekarrys: read spec and figure out what portions of it we can/should adhere to
- Action item @lukekarrys: look into how other tools use engines field in case there is differing behavior on warning/erroring for engines mismatch
1. PR: #595 Propose backwards-compatible improvements to compression - @EvanHahn
- New compression algorithim zopfli other than gzip which shows a 5% improvement in initial tests
- Concerns about a pure JS solution or a WASM solution on the cli being untenable
- If it was in the language it would be a much easier decision
- How is zopfli licensed?
- Gar: we should look into whether this can solve the bug of machine specific integrity values
- Higher level: does this make registry storage better? Or CPU time in aggregate? Can incentives be aligned to cut costs for registry/actions/etc?
- This is currently only at publish time
- Zopfli is Apache-2 licensed
1. PR: #593 Only Registry Tarballs - @thescientist13
- Wes: Also wrote a tool for detecting git dependencies in lockfiles or trees
- Is there an aggregate RFC for all the subcommands or actions that npm audit could run?
- Compile a list of new audit features and come up with a high level foundation that would enable this RFC as well as other audit checks
- How would this interface with `npm query`? npm query could be added after this RFC which would allow only a queryable subset of packages to be checked
- eslint style rules which could implement this check as well as others. Action item @lukekarrys/@wesleytodd: this should be a new RFC
1. PR: #591 RFC: Registry-scoped keyfile / certfile credential options - @jenseng
- Ready for implementation! Action item: @jenseng
- Reach out to the npm team if you need assistance with implementation
1. PR: #165 RFC for parent package.json - @Christian24
- Action items: review RFC since it has been stale for a few years