The docs list this caveat: > Note that previous stable versions will not be sugg... | Hacker News

Hacker Newsnew | past | comments | ask | show | jobs | submit

		tragiclos 17 days ago \| parent \| context \| favorite \| on: Shai-Hulud Returns: Over 300 NPM Packages Infected The docs list this caveat: > Note that previous stable versions will not be suggested. The package will be completely ignored if its latest published version is within the cooldown period. Seems like a big drawback to this approach.

nfriedly 17 days ago [–]

I could see it being a good feature. If there have been two versions published within the last week or two, then there are reasonable odds that the previous one had a bug.

hokkos 17 days ago | [–]

some lib literally publish a new package at every PR merged, so multiple times a day.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact