Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: add npm bin to transparent commands #159

Closed
wants to merge 1 commit into from
Closed

Conversation

styfle
Copy link
Member

@styfle styfle commented Aug 10, 2022

@aduh95
Copy link
Contributor

aduh95 commented Aug 15, 2022

Sorry for my ignorance, what's the use-case for using npm bin in a non-npm package?

Docs: https://docs.npmjs.com/cli/v8/commands/npm-bin

@arcanis
Copy link
Contributor

arcanis commented Aug 15, 2022

I agree, I don't see how npm bin is relevant to non-npm projects (except maybe when the -g flag is set, but this PR doesn't check that).

@styfle
Copy link
Member Author

styfle commented Aug 24, 2022

what's the use-case for using npm bin in a non-npm package?

Its useful to append to the PATH so that you can run scripts like tsc instead of ./node_modules/.bin/tsc.

https://github.com/vercel/vercel/blob/e34858d0828d97a7ccdedc36ff739cd051e20101/packages/next/src/index.ts#L429-L430

@ljharb
Copy link
Member

ljharb commented Aug 24, 2022

Note that npm 9 is removing npm bin

@styfle
Copy link
Member Author

styfle commented Aug 24, 2022

@ljharb Where do you see that? Its not currently deprecated. Is there a roadmap I missed?

@ljharb
Copy link
Member

ljharb commented Aug 24, 2022

@styfle npm/statusboard#537

@merceyz
Copy link
Member

merceyz commented Aug 24, 2022

what's the use-case for using npm bin in a non-npm package?

Its useful to append to the PATH so that you can run scripts like tsc instead of ./node_modules/.bin/tsc.

https://github.com/vercel/vercel/blob/e34858d0828d97a7ccdedc36ff739cd051e20101/packages/next/src/index.ts#L429-L430

That's assuming the package manager used by the project implements the same behaviour as current versions of npm, which isn't guaranteed.

@ljharb
Copy link
Member

ljharb commented Aug 24, 2022

It's also worth noting that that use case is wildly insecure and dangerous, because of the potential for a package to silently shadow a system command.

@styfle styfle closed this Aug 29, 2022
@styfle styfle deleted the patch-2 branch August 29, 2022 22:56
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

5 participants