danielroe 🇺🇦
@danielroe.dev
🏡 https://roe.dev
➕ building @nuxt.com • @nitro.build • https://elk.zone
💝 https://page-speed.dev • https://firstcommit.is • https://react-to-nuxt.com
🏅 Google GDE • Microsoft MVP • GitHub ⭐️
signal: danielroe.57
🧗♂️ ⛷️ 🚴♂️ ✝️
📍 edinburgh 🏴
➕ building @nuxt.com • @nitro.build • https://elk.zone
💝 https://page-speed.dev • https://firstcommit.is • https://react-to-nuxt.com
🏅 Google GDE • Microsoft MVP • GitHub ⭐️
signal: danielroe.57
🧗♂️ ⛷️ 🚴♂️ ✝️
📍 edinburgh 🏴
don't let me stop you!!
November 12, 2025 at 9:52 PM
don't let me stop you!!
is that just one of your font folders or...
November 12, 2025 at 9:49 PM
is that just one of your font folders or...
you are extremely close
November 12, 2025 at 9:40 PM
you are extremely close
but you've just given the game away so we can all judge
😈
😈
November 12, 2025 at 9:40 PM
but you've just given the game away so we can all judge
😈
😈
i know which one i like
November 12, 2025 at 8:56 PM
i know which one i like
you probably need to check your dns to make sure the atproto txt record is correct
November 12, 2025 at 6:42 PM
you probably need to check your dns to make sure the atproto txt record is correct
🤫 you have to ... write react
November 12, 2025 at 5:52 PM
🤫 you have to ... write react
November 12, 2025 at 5:20 PM
... and yes, it must be considering prerelease versions, which _do_ have provenance (but the final versions don't)
November 11, 2025 at 11:24 PM
... and yes, it must be considering prerelease versions, which _do_ have provenance (but the final versions don't)
the issue is that `[email protected]` (or `[email protected]`, which it sometimes also throws at in this particular example) is _already_ in the lockfile (ie. has been determined safe by me)
I don't want it to _downgrade_ but it's just refusing to install packages that were already installed
I don't want it to _downgrade_ but it's just refusing to install packages that were already installed
November 11, 2025 at 11:22 PM
the issue is that `[email protected]` (or `[email protected]`, which it sometimes also throws at in this particular example) is _already_ in the lockfile (ie. has been determined safe by me)
I don't want it to _downgrade_ but it's just refusing to install packages that were already installed
I don't want it to _downgrade_ but it's just refusing to install packages that were already installed
no, I treat them more as a signal to be consumed by stuff like socket.dev or renovatebot.com.
the _loss_ of provenance I treat as a signal to investigate.
the _loss_ of provenance I treat as a signal to investigate.
November 11, 2025 at 11:20 PM
no, I treat them more as a signal to be consumed by stuff like socket.dev or renovatebot.com.
the _loss_ of provenance I treat as a signal to investigate.
the _loss_ of provenance I treat as a signal to investigate.
you mean, do i verify them on a new release?
November 11, 2025 at 8:12 PM
you mean, do i verify them on a new release?
enough that i’ve had to stop using the feature due to false positives (like chokidar)
November 11, 2025 at 7:30 PM
enough that i’ve had to stop using the feature due to false positives (like chokidar)
i think exceptions should be not just by package name but by name and version
November 11, 2025 at 7:00 PM
i think exceptions should be not just by package name but by name and version
i feel like enabling a ‘ratchet’ (eg always more secure than before) is the better way to improve supply chain security
November 11, 2025 at 7:00 PM
i feel like enabling a ‘ratchet’ (eg always more secure than before) is the better way to improve supply chain security
that just makes it impossible to use at the moment
November 11, 2025 at 6:58 PM
that just makes it impossible to use at the moment
i need to see if i can reproduce but my assumption is that this prevents install if _any_ previous version had stronger provenance
but i want it to prevent install only if in _this_ lockfile change there is a regression
but i want it to prevent install only if in _this_ lockfile change there is a regression
November 11, 2025 at 5:43 PM
i need to see if i can reproduce but my assumption is that this prevents install if _any_ previous version had stronger provenance
but i want it to prevent install only if in _this_ lockfile change there is a regression
but i want it to prevent install only if in _this_ lockfile change there is a regression
actually, I may have spoken too soon.
I've had to revert switching to pnpm's native solution, personally, as it seems to be over-eager to trigger 🤔
I've had to revert switching to pnpm's native solution, personally, as it seems to be over-eager to trigger 🤔
November 11, 2025 at 4:57 PM
actually, I may have spoken too soon.
I've had to revert switching to pnpm's native solution, personally, as it seems to be over-eager to trigger 🤔
I've had to revert switching to pnpm's native solution, personally, as it seems to be over-eager to trigger 🤔