npm's min-release-age setting delays installs of brand-new package versions to limit supply chain attack risk

·2 views

A developer argues that setting a minimum release age in npm is a cheap security measure for JavaScript projects. The setting makes npm install only package versions that have been published for a set number of days, which avoids the window when malicious versions are live before registries or scanners remove them. The article notes that similar waiting periods exist in pnpm, Yarn, Bun, Dependabot and Renovate, and that GitHub previewed a package firewall with such a delay on October 20. It also warns that npm ci and installs using an existing lockfile skip the age check, so a lockfile check is needed in CI, and that urgent security fixes require a deliberate exception path.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Home-Hosted Freelance Lead Scanner Uses Recency Windows and Board Rules to Filter Listings

A developer built a lightweight filter layer for a home-hosted freelance lead scanner to address stale listings and noisy results from job boards. The scanner runs on a Raspberry Pi 4 in the garage, with a cron job triggering a Node.js script every 30 minutes to fetch, normalise, and filter listings. Each board has its own recency window, defined in a configuration file, so only recently posted jobs pass through. Board-specific rules and a central filters module let the developer adjust logic without changing the scraper. Surviving leads are sent to a Slack webhook, and the filter functions are kept free of I/O so they can be unit tested.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Atlassian's Teamwork Graph: How Rovo Stores and Links Connected Work Data

Atlassian's AI assistant Rovo can answer questions using files from outside Atlassian, such as SharePoint or Google Drive, because connectors copy synced workspaces into a store called the Teamwork Graph. The graph maps how work items, pages, people and connected tools relate to one another, and Rovo reads it directly without any user installation. In a test on an organization with no third-party tools connected, Rovo linked a Jira project to two Confluence pages with no explicit links, though a plain text search could have found them without the graph. Atlassian has announced that from 15 November 2026 it will index content behind authorized third-party links, and that code indexing will turn on automatically by January 2027, dates the author could not find in public documentation. The author also notes that Atlassian's published figures for graph size and connector counts are inconsistent across its own materials.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why the Turing Test No Longer Reveals Whether AI Truly Thinks

A new analysis argues that the Turing Test has lost its power to diagnose machine intelligence now that large language models can convincingly mimic human conversation. It cites research showing that GPT-4.5 is often judged indistinguishable from a human in conversation. The debate is therefore shifting from whether AI is intelligent to how its outputs are produced. The author proposes replacing single-test evaluation with scattering experiments, drawing on ideas from Douglas Hofstadter and the FARG program. These experiments would examine how a system responds across diverse and atypical situations, separating superficial imitation from genuine underlying competence.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Six Checks to Stop Silent Logouts in Next.js and Supabase Auth Cookies

AI-generated Next.js apps using Supabase often work on localhost but log users out right after production deployment. The article attributes most of these failures to cookie configuration, middleware session refresh, or mismatched Preview and Production environment settings rather than a Supabase outage. Key recommendations include matching the cookie domain to the production host, requiring Secure cookies over HTTPS, and keeping each environment tied to its intended Supabase project. The piece also advises refreshing sessions in middleware, listing all Preview and production URLs in Supabase, and checking that login and callback routes are not caught in redirect loops. It closes with a five-step verification routine to confirm that session behavior is stable after deployment.

0 comments Read more at DEV Community