Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add "410 Gone" RFC for unpublished modules #111

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

markstos
Copy link

@markstos markstos commented Dec 6, 2018

Unpublished packages currently cause pain for yarn users. A recommended approach ends up being to delete yarn.lock and re-generate it, which can cause a huge amount of dependencies to change when only one was needed.

Unpublished packages currently return the HTTP status code "404 Not Found". This code is designed for resources that might exist again in the future. In the NPM ecosystem, version numbers are wisely immutable. A better HTTP status code to return for an unpublished package is "410 Gone", designed for resources that will never come back.

When yarn encounters a 410 Gone resource, it could try to resolve the related semantic version again, possibly selecting a newer version, fixing the issue the single dependency without requiring regenerating all of "yarn.lock".

@ljharb
Copy link

ljharb commented Dec 6, 2018

Status codes come from the public registry, which has nothing to do with yarn itself. Is this a change the npm registry is planning to make?

@markstos
Copy link
Author

markstos commented Dec 6, 2018

@ljharb Yarn chooses to setup registry.yarnpkg.org as the source for most package downloads, not npmjs.org. This proxy can choose to return it's own codes, however, I'm not sure this proxy is aware of which modules have been unpublished. I have not been in conversation with npm, Inc about this proposal thus far.

@ljharb
Copy link

ljharb commented Dec 6, 2018

I'd suggest starting a conversation with npm - since as you say, even if the CNAME was set up as an actual server, it'd still have no way to know what's been unpublished.

@markstos
Copy link
Author

markstos commented Dec 6, 2018

@ljharb Thanks for the feedback. I'll do that and report back.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants