Opened 13 years ago

Closed 13 years ago

#31161 closed enhancement (fixed)

npm: users should not run "npm update npm -g"

Reported by: ryandesign (Ryan Carsten Schmidt) Owned by: ci42
Priority: Normal Milestone:
Component: ports Version:
Keywords: Cc:
Port: npm

Description

According to the npm faq, users can update npm itself by running:

npm update npm -g

But we don't want users to do that; we want users to use MacPorts to upgrade software that was installed using MacPorts.

I see two approaches we could use:

  1. Add a sentence to the notes field telling the user not to use "npm update npm -g"
    • Pros: easy to implement
    • Cons: easy for the user to ignore, forget, or overlook
  2. Override "npm update npm -g" and replace it with a message advising the user to run "sudo port selfupdate && sudo port upgrade npm" instead
    • Pros: eliminates possibility for user error
    • Cons: harder to implement

I prefer option 2 if it's not too difficult. The ways I see of doing it are:

  1. Override "npm update npm -g"
    1. Write a wrapper script around npm
      • Pros: changes to npm won't necessitate rewriting the wrapper
      • Cons: if npm accepts optional arguments, or arguments in arbitrary order, getting the argument parsing right in the wrapper will be involved
    2. Patch npm
      • Pros: avoids a layer of abstraction for all the other npm commands the user will run
      • Cons: new versions of npm may invalidate our patches and require us to rewrite them

A third possibility would be to get the developers of npm to include a configuration option to disable "npm update npm -g". Not sure if they would be willing to offer that.

Change History (3)

comment:1 Changed 13 years ago by ryandesign (Ryan Carsten Schmidt)

Summary: npm: users should not run "npm update"npm: users should not run "npm update npm -g"

comment:2 Changed 13 years ago by ryandesign (Ryan Carsten Schmidt)

Version: 2.0.2

comment:3 in reply to:  description Changed 13 years ago by ci42

Resolution: fixed
Status: newclosed
  1. Override "npm update npm -g"
    1. Patch npm

Done in r83821.

Note: See TracTickets for help on using tickets.