search

jspm / npm

NPM Location Service
19 stars 34 forks source link

github: is a valid dependency format for npm #101

Closed ghost closed 8 years ago

ghost commented 8 years ago

​

guybedford commented 8 years ago

Thanks for posting. The https://github.com case is filtered out in the first part of the conditional.

I did not know github:owner/repo was a valid dependency format on npm? It is not listed in https://docs.npmjs.com/files/package.json#dependencies.

guybedford commented 8 years ago

Thanks, you're completely right, we should support this.

letmaik commented 8 years ago

The issue with this is that it requires to actually build the package first, otherwise some packages may just end up broken. Packages published on npm are already built (ignoring postinstall for now) but using a direct git dependency means it potentially needs the build step (or install or prepublish or whatever npm phase that corresponds to). I wouldn't worry too much about security when running scripts since the user opts-in to that by using a "source" dependency.

In my case, the build step is just transpilation (which however is the difference between src/ vs transpiled/ folders and having the correct path in "main").

guybedford commented 8 years ago

@neothemachine the build operations are a separate issue to this one I believe, which has actually been fixed. Happy to continue that discussion though.