Minimum release age for @latest
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 45/100
- Issue type
- Feature
- Clarity
- Mostly clear
- Activity status
- Quiet
- Tech stack
- nodejs, typescript
Research direction
Start by reproducing corepack prepare pnpm@latest --activate and tracing how the @latest tag is resolved. Define the expected behavior for a proposed minReleaseAge setting and verify that recently published versions are excluded while older versions remain eligible.
Written by the indexing model from the issue text.
Description
When running for example corepack prepare pnpm@latest --activate the corepack will apparently install the latest tag even if it was created just minutes ago. In case the package manager is compromised and a malicious version of it is published, corepack users might get it installed if their timing is unlucky.
Would it make sense for corepack to support something like minReleaseAge to give security researchers time to detect compromised versions?
- Dominant language
- TypeScript
- Stars
- 3.8k
- Forks
- 279
- Avg merge
- 1h 47m
- Merged PRs (30d)
- 2
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from nodejs/corepack
-
Difficulty 2/5 1-3 hours Newbie friendliness 64/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
-
Difficulty 4/5 3-5 days Newbie friendliness 68/100
-
Difficulty 3/5 1-2 days Newbie friendliness 52/100
-
Difficulty 3/5 1-2 days Newbie friendliness 68/100
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
safetrustcr/dApp-SafeTrust#426 ·
-
area:workflow bug ready-for-agent
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
fil-donadoni/tolaria#4409 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
Fission-AI/OpenSpec#1960 ·
-
Add dependabot Open
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
corsairdev/corsair#1764 ·