{"action":"created","issue":{"url":"https://api.github.com/repos/hapijs/hapi/issues/3360","repository_url":"https://api.github.com/repos/hapijs/hapi","labels_url":"https://api.github.com/repos/hapijs/hapi/issues/3360/labels{/name}","comments_url":"https://api.github.com/repos/hapijs/hapi/issues/3360/comments","events_url":"https://api.github.com/repos/hapijs/hapi/issues/3360/events","html_url":"https://github.com/hapijs/hapi/issues/3360","id":181303743,"number":3360,"title":"potential 🧀 moving in shrinkwrap behavior in npm@4","user":{"login":"othiym23","id":418097,"avatar_url":"https://avatars.githubusercontent.com/u/418097?v=3","gravatar_id":"","url":"https://api.github.com/users/othiym23","html_url":"https://github.com/othiym23","followers_url":"https://api.github.com/users/othiym23/followers","following_url":"https://api.github.com/users/othiym23/following{/other_user}","gists_url":"https://api.github.com/users/othiym23/gists{/gist_id}","starred_url":"https://api.github.com/users/othiym23/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/othiym23/subscriptions","organizations_url":"https://api.github.com/users/othiym23/orgs","repos_url":"https://api.github.com/users/othiym23/repos","events_url":"https://api.github.com/users/othiym23/events{/privacy}","received_events_url":"https://api.github.com/users/othiym23/received_events","type":"User","site_admin":false},"labels":[{"id":64612888,"url":"https://api.github.com/repos/hapijs/hapi/labels/discussion","name":"discussion","color":"d4c5f9","default":false}],"state":"closed","locked":false,"assignee":{"login":"hueniverse","id":56631,"avatar_url":"https://avatars.githubusercontent.com/u/56631?v=3","gravatar_id":"","url":"https://api.github.com/users/hueniverse","html_url":"https://github.com/hueniverse","followers_url":"https://api.github.com/users/hueniverse/followers","following_url":"https://api.github.com/users/hueniverse/following{/other_user}","gists_url":"https://api.github.com/users/hueniverse/gists{/gist_id}","starred_url":"https://api.github.com/users/hueniverse/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/hueniverse/subscriptions","organizations_url":"https://api.github.com/users/hueniverse/orgs","repos_url":"https://api.github.com/users/hueniverse/repos","events_url":"https://api.github.com/users/hueniverse/events{/privacy}","received_events_url":"https://api.github.com/users/hueniverse/received_events","type":"User","site_admin":false},"assignees":[{"login":"hueniverse","id":56631,"avatar_url":"https://avatars.githubusercontent.com/u/56631?v=3","gravatar_id":"","url":"https://api.github.com/users/hueniverse","html_url":"https://github.com/hueniverse","followers_url":"https://api.github.com/users/hueniverse/followers","following_url":"https://api.github.com/users/hueniverse/following{/other_user}","gists_url":"https://api.github.com/users/hueniverse/gists{/gist_id}","starred_url":"https://api.github.com/users/hueniverse/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/hueniverse/subscriptions","organizations_url":"https://api.github.com/users/hueniverse/orgs","repos_url":"https://api.github.com/users/hueniverse/repos","events_url":"https://api.github.com/users/hueniverse/events{/privacy}","received_events_url":"https://api.github.com/users/hueniverse/received_events","type":"User","site_admin":false}],"milestone":null,"comments":4,"created_at":"2016-10-06T01:17:48Z","updated_at":"2016-12-28T20:19:07Z","closed_at":"2016-10-08T20:09:28Z","body":"Hello, Hapi friends and fellow open source maintainers!\n\nAs some of you probably know, I'm the lead maintainer for the npm CLI. We're getting ready to release npm@4 in the near future. Unlike `npm@3`, it's kind of a catch-all release to push out a bunch of smaller breaking changes (some of which are [a bit overdue](https://github.com/npm/npm/issues/10074)), and we don't expect it to have a large impact on most developers.\n\nHowever, also unlike `npm@3`, `npm@4` will potentially have a significant impact on Hapi. This is because one of the other purposes of `npm@4` is to set us up for `npm@5`, which is provisionally entitled \"The One Where We Make Shrinkwrap Useful For Everybody\". As part of this, in `npm@4` we intend to close a loophole that Hapi's been using pretty much since the beginning, and make it so that _only packages included in `npm-shrinkwrap.json` will be installed, even if other dependencies are enumerated in `package.json`_.\n\nPretty much the only reason we didn't close this loophole in `npm@3` was because we knew Hapi was relying on it. npm's dependency locking has historically been underdocumented, so it seemed like fair game to let Hapi use that as a way of fixing specific transitive dependencies without pinning all of them. It still seems like a use case that we should support. It happens, though, that there are a number of painful architectural consequences of supporting this behavior that interfere with us both making installs faster and getting shrinkwrapping to where we think it should be.\n\nBecause this is fairly late in the release process for `npm@4` (for which I give my apologies; this has been on my to-do list for a while), if this is going to present significant problems for y'all, let me know and we can work something out. My concern is that pushing _all_ of the shrinkwrap changes off to `npm@5` is going to make it even more disruptive change than it would be otherwise, and also eliminating the behavior Hapi's shrinkwrap relies upon also removes a large source of edge cases for the installer, so it's a big step forward for overall quality of the CLI.\n\nThanks for your time, and let me know if this is a showstopper for you, or (with luck!) no big deal.\n"},"comment":{"url":"https://api.github.com/repos/hapijs/hapi/issues/comments/269534633","html_url":"https://github.com/hapijs/hapi/issues/3360#issuecomment-269534633","issue_url":"https://api.github.com/repos/hapijs/hapi/issues/3360","id":269534633,"user":{"login":"cjihrig","id":2512748,"avatar_url":"https://avatars.githubusercontent.com/u/2512748?v=3","gravatar_id":"","url":"https://api.github.com/users/cjihrig","html_url":"https://github.com/cjihrig","followers_url":"https://api.github.com/users/cjihrig/followers","following_url":"https://api.github.com/users/cjihrig/following{/other_user}","gists_url":"https://api.github.com/users/cjihrig/gists{/gist_id}","starred_url":"https://api.github.com/users/cjihrig/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cjihrig/subscriptions","organizations_url":"https://api.github.com/users/cjihrig/orgs","repos_url":"https://api.github.com/users/cjihrig/repos","events_url":"https://api.github.com/users/cjihrig/events{/privacy}","received_events_url":"https://api.github.com/users/cjihrig/received_events","type":"User","site_admin":false},"created_at":"2016-12-28T20:19:07Z","updated_at":"2016-12-28T20:19:07Z","body":"@hueniverse Node core is considering shipping an updated npm with breaking changes in v7. Is this something that hapi is prepared to deal with in the middle of a release line?\r\n\r\ncc: @thealphanerd"}}
{"actor":{"display_login":"cjihrig"}}