---
# System prepended metadata

title: Open RFC Meeting (npm)

---

#### Meeting from: August 19th, 2020

# Open RFC Meeting (npm)

### Attendees
- Ruy Adorno (@ruyadorno)
- Isaac Z. Schlueter (@isaacs)
- Christian Siebmanns (@christian24)
- Jordan Harband (@ljharb)
- Myles Borins (@MylesBorins)
- Lukas Spieß (@lumaxis)
- Wes Todd (@wesleytodd)
- Tierney Cyren (@bnb)

### Agenda
1. **Housekeeping**
	1. Introduction(s)
	1. Code of Conduct Acknowledgement
	1. Outline Intentions & Desired Outcomes
	1. Announcements
1. **PR**: [#129 RFC: overrides](https://github.com/npm/rfcs/pull/129) - @isaacs
1. **PR**: [#126 RFC: Adding types information to the Package JSON in the  registry](https://github.com/npm/rfcs/pull/126) - @orta
1. **PR**: [#1674 Rfc 0027 npm audit app id](https://github.com/npm/cli/pull/1674) - @doddi
1. **PR**: [#1586 [Feature] Security Pipeline](https://github.com/npm/cli/pull/1586) - @jskoll
1. **Issue**: [#190 [RRFC] npm run-series &amp;&amp; npm run-parallel](https://github.com/npm/rfcs/issues/190) - @MylesBorins
1. **PR**: [#185 RFC: Add ability to skip script hooks](https://github.com/npm/rfcs/pull/185) - @lumaxis
1. **PR**: [#183 RFC21: bring back subset of npm_package_* environs](https://github.com/npm/rfcs/pull/183) - @isaacs
1. **PR**: [#182 RFC: npm audit licenses](https://github.com/npm/rfcs/pull/182) - @bnb
1. **PR**: [#165 RFC for parent package.json](https://github.com/npm/rfcs/pull/165) - @Christian24

### Notes

- overrides
    - wes: inheriting overrides from an external source?
    - isaacs: will be implied by RFC #165 parent package.json
- types: not much updates, been heads-down on v7
- appid
    - mark: doing audits tailored to each individual application
    - wes: would be nice to use for other general project/packge linting stuff
    - discussion of new audit bulk advisory endpoint vs quickaudit endpoint, scaling and perf
    - isaacs: not great to use audit to do project linting, but project linting is a good thing
    - send appid (or something) in header rather than POST request body
- security pipeline
    - let's do this in v7, latest is known legacy outdated 
- run-series, run-parallel
    - punt, covered in last meeting
    - issues brought up, still pending discussion, but urgent.
    - move to remove from agenda until practical/speicfici to discuss
    - concerns about scope, series cleaner than parallel, one point about whether we want to make it more complicated at all
    - maybe drop parallel and just add series to have a platform-agnostic alternative to `&&`
- add ability to skip script-hooks
    -  isaacs: we should do this
    -  isaacs: move to accepted today
- bring back subset of npm_package_* environs
    - isaacs: not everything is being included anymore, but most are
    - isaacs: a custom node script can be used if you need everything
- npm audit licenses
    - tierney: could use more feedback to help figure out next steps (written please)
    - discussion about the licensee project and how it can potentially be used
- parent package.json
    - does not require first-class support from node
    - imports/exports not inherited (probably?)