NPM Inc, the company overseeing the development of the NPM package manager and maintaining the NPM repository, higher level of isolation, as if one controller is broken, the problem is confined to that specific context). its business to Microsoft. GitHub is named as the buyer in the deal, operating as an independent business unit of Microsoft. The deal's amount is not disclosed.
It is claimed that the change of ownership will not affect the repository , which will continue to exist and remain public and free for open-source developers. Development of the NPM package manager will continue with additional resources, which may encourage more active development. GitHub intends to actively engage with the JavaScript developer community to gather ideas and determine the future of NPM.
The main vectors of development mentioned include improving the reliability, scalability, and performance of the repository and infrastructure, as well as enhancing the everyday workflow for developers working with the package manager. Among the significant innovations expected in npm 7 are workspaces (, which allow aggregating dependencies from multiple packages into a single package for installation in one step), improvements in the package publishing process, and expanded support for multi-factor authentication.
To enhance the security of package publishing and delivery processes, integration of NPM into the GitHub infrastructure is planned. This integration will also allow using the GitHub interface for preparing and hosting NPM packages — changes in packages can be tracked in GitHub from the time of pull request submission to the publication of a new version of the npm package. The tools provided in GitHub vulnerabilities and about vulnerabilities in repositories will also apply to NPM packages. To fund the work of maintainers and authors of NPM packages, the service .
Isaac Z. Schlueter, the creator of NPM, will continue to work on the project and will be provided with additional resources and a calmer environment to operate. The founder of NPM believes that as part of GitHub, NPM will receive extra support from one of the largest global companies backing the biggest developer community. Currently, the NPM repository serves over 1.3 million packages used by around 12 million developers. Each month, approximately 75 billion downloads are recorded, and this number is steadily rising.
It should be noted that last year NPM Inc experienced a leadership change, a series of employee layoffs, and the search for investors. Due to the uncertainty surrounding the future of NPM and a lack of trust that the company would advocate for the community rather than investors, a group of employees led by the former CTO of NPM a package repository . The new project aims to eliminate the JavaScript/Node.js ecosystem's dependency on a single company that wholly controls the development of the package manager and the maintenance of the repository. According to the founders of Entropic, the community lacks leverage to hold NPM Inc accountable for its actions, and a profit-driven focus interferes with the implementation of primary opportunities that are valuable to the community but do not generate income and require additional resources, such as support for digital signature verification.
Source: opennet.ru
