releases available via npm

I just found out that currently only the latest version of ecstatic is available via npm:

$ npm view ecstatic versions  --json
[
  "4.1.2"
]

Could you make the older versions available as well? There are a lot of libraries that are using this module and removing older version can break the build.

[nolman]

It’s unclear to me why someone (not sure who) decided that old versions needed to be unpublished. Typical best practice is to leave these old vulnerable versions out and give people an advisory to update. There are people like myself who use this library in a context where the vulnerable did not impact us (only used in CI), however what did impact us was pulling the old versions from NPM and breaking all of our builds.

I appreciate this open source software, the people who make it and the time they spend in doing so. That said when people start to depend on your work it is impolite to remove it with no recommended upgrade path. Sure your time is limited, or you don’t want to maintain this library anymore, that’s okay I get it. However when you pull packages from NPM you are needlessly taking time from other people.

[Blackbaud-PaulCrowder]

Or perhaps backport the security fix to 3.x and 2.x so that the Internet is no longer broken. This is having ripple effects across a huge number of consumers right now.