Skip to content

Say who can depend on the tarball: an application, not a library - #3

Open
sidorares wants to merge 2 commits into
masterfrom
npm12-caveat
Open

sidorares wants to merge 2 commits into
masterfrom
npm12-caveat

Conversation

@sidorares

Copy link
Copy Markdown

WINDOWKIT.md and the release workflow said a dependent names the tarball's URL. That holds for an application and not for a published library: npm 12 defaults allow-remote and allow-git to none, an application can allow its own with allow-remote=root, and a library's dependency is a dependency of a dependency to whoever installs it.

ntk 8.17.2 depended on the tarball and could not be published: its publish job failed in npm ci with EALLOWREMOTE. ntk goes back to fontkit from npm and does the work itself in sidorares/ntk#485, so nothing depends on this fork now.

Also moves the workflow's two actions from v4 to v7, which ntk uses, since v4 ran with a Node 20 deprecation warning. The workflow runs only on a release tag, so that change is not exercised by this PR.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant