Skip to content

Conversation

outslept
Copy link
Contributor

@outslept outslept commented Aug 15, 2025

Since we don't configure any private registries or authentication, we don't need the latest-version dependency that pulls in 16 additional packages for features we don't use. Engines declares node 22.16.0 and fetch became stable around ~21-ish.

image

Using fast-npm-meta by antfu is a matter of preference. I like it more as it provides basic caching - alternatively, we can make a direct request to https://registry.npmjs.org/@sentry/core/latest which has a slightly larger payload but eliminates any external service dependency.

UPD: npm's rate limiting is described here and it's generous imo https://docs.npmjs.com/policies/open-source-terms#acceptable-use (see number 17).

But to draw one clear line, under no circumstances are five million requests to npm Services in a single month-long period by any single individual, organization, or group of affiliated companies remotely reasonable.

@AbhiPrasad AbhiPrasad requested a review from timfish August 18, 2025 19:08
@timfish timfish enabled auto-merge (squash) August 27, 2025 09:34
@timfish timfish merged commit df8cf6b into getsentry:master Aug 27, 2025
169 of 187 checks passed
@outslept outslept deleted the fix/latest-version-with-fetch branch August 27, 2025 09:38
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants