Suggestion: add standard methods to limit APIs dependencies can use about package-maintenance HOT 4 CLOSED

I think this is probably out-of-scope

from package-maintenance.

This would be useful, but it's mainly a node core feature. As such, it is out of scope.

Most of the discussion is happening in nodejs/node#22112 and nodejs/security-wg#457.

I'm closing this issue to reduce noise, but please join the discussion on the two links I posted above.

from package-maintenance.

I agree that this is out of scope for this group.

I believe Ryan Dahl talked about this in his Deno presentation with flags to allow process access to certain api's, interesting stuff.

from package-maintenance.

I believe this has a overlap area with the scope, because being able to use dependencies without a fault in one of them causing a massive failure improves the maintainability of projects in my opinion.

Having to check if the dependencies are safe for usage is a maintainer problem.

Think, for example, of all the maintainers who, for example, got affected by the event-stream problem and had to immediately take action of replacing the dependency.

This feature would give the maintainer a reasonable time to make the change, without having anyone's security at risk.

from package-maintenance.