Post

Publishing a large monorepo of interdepent modules has become impossible with the new change on npm: the new scan thing delays every publishing substantially, and it does not recognize a batch. Maybe one should try doing a staged publishing and then do 15-20 clicks to approve them all?

8/9/26, 3:59 pm2 reposts8 likes

Vladimir

There is no other reasonable option left. Only staged publish. The minute it shipped (ok, a few weeks after, fixes) it was the best option. Now it's necessary. If scanning has any purpose in the context of Socket doing it better anyway, it is introducing friction to other publishing methods.

naugtur

@naugtur.pl

8 Sept

The bad part is, when you stage things, you can't pre-approve them. You have to wait. Which is not a problem when you want to coordinate publishing. I wonder if there's a way to get a notification when scanning is over

naugtur

@naugtur.pl

8 Sept

Anyway, I already figured out how to cheat react on NPM UIs to accept clicks from a bookmarklet, so I'll probably automate that too - approve staged packages from a time range or a fixed list

Trivikram Kamat

@trivikram.bsky.social

8 Sept

If npm provides a way to get scan status - say similar to `npm stage` - the monorepo release scripts can wait for dependent module to be "published" before publish attempt it made on the module depending on it. I'd provided this feedback on July 29th github.com/orgs/communi...

github.comPublish-time malware scanning: how should tooling tell "pending scan" apart from "never published"? · community · Discussion #203395🏷️ Discussion Type Question Body Publish-time malware scanning introduces a window where a version has been accepted by the registry but is not yet installable. The changelog says npm dist-tag keep...