vlt

Package management sits at the foundation of modern software development, quietly powering nearly every software project in the world. Tools like npm and Yarn have long been the core of the JavaScript ecosystem, enabling developers to install, update, and share code with ease. But as projects grow larger and the ecosystem more complex, this older infrastructure is beginning to show its limits with performance bottlenecks, dependency conflicts, and growing concerns around supply chain security. Darcy Clarke and Ruy Adorno are veterans of this ecosystem. Both spent years maintaining the npm CLI and helping guide the Node.js project, where they saw firsthand the technical debt and design tradeoffs that define modern JavaScript tooling. Now they’re building vlt, a new package manager and registry that rethinks performance, security, and developer experience from the ground up. In this episode, Darcy and Ruy join Josh Goldberg to discuss how vlt works, why they believe package management needs a server-side reboot, what lessons they’ve drawn from npm’s evolution, and how features like declarative querying, self-hosted registries, and real-time security scanning could reshape how developers build and share JavaScript in the years ahead. Josh Goldberg is an independent full time open source developer in the TypeScript ecosystem. He works on projects that help developers write better TypeScript more easily, most notably on typescript-eslint: the tooling that enables ESLint and Prettier to run on TypeScript code. Josh regularly contributes to open source projects in the ecosystem such as ESLint and TypeScript. Josh is a Microsoft MVP for developer technologies and the author of the acclaimed Learning TypeScript (O’Reilly), a cherished resource for any developer seeking to learn TypeScript without any prior experience outside of JavaScript. Josh regularly presents talks and workshops at bootcamps, conferences, and meetups to share knowledge on TypeScript, static analysis, open source, and general frontend and web development. Please click here to see the transcript of this episode. Sponsorship inquiries: sponsor@softwareengineeringdaily.com The post Next-Gen JavaScript Package Management with Ruy Adorno and Darcy Clarke appeared first on Software Engineering Daily.

Darcy Clarke

Co-founder

npmvltGitHub

Ruy Adorno

npm

In this supper club episode of Syntax, Wes and Scott talk with Darcy Clarke about his career path in tech, working with Wes back in the day, why he decided to build vlt volt, and the biggest sick pick list yet! Show Notes 00:32 Welcome 01:38 Building a tweet wall back in the day 08:54 How did you land at npm? npm 19:40 Why do we need another package manager and registry? 22:11 What is vlt volt? vlt: a new home for open source vlt /vōlt/ (@vltpkg) / X Shipping ESM with Mark Erikson Bun Yarn Nx 27:18 Do you see a future where we don’t pre-compile before shipping? 29:32 Why would pnpm be faster than npm? 31:14 What are the problems with symlinking? 33:08 What’s happening with Yarn? Verdaccio Cloudsmith jfrong Sonatype socket.dev Snyk.io Dependency Confusion 37:42 What do you think about config files? antfu Config of File Nesting for VS Code The massive bug at the heart of the npm ecosystem WebTorrent 41:02 VS Code tip - file nesting patterns 41:59 How does on-prem registry work? 47:29 Where does Socket.dev and Snyk security fit? 52:46 Sick Picks 04:41 How did you get vlt.sh? 05:30 How did you get @Darcy? Sick Picks Flat Coat Goldendoodle Scientific American Nespresso BlackBerry (2023) - IMDb BlackBerry (2023) Letterboxd Matthias Wandel Blink-182 Official Site Moneen Bring Me The Horizon Shameless Plugs vlt: a new home for open source Hit us up on Socials! Syntax: X Instagram Tiktok LinkedIn Threads Wes: X Instagram Tiktok LinkedIn Threads Scott: X Instagram Tiktok LinkedIn Threads

Darcy Clarke

Co-founder

npmvltGitHub

Darcy Clarke, former GitHub Staff Engineering Manager and founder of vlt, joins us to discuss a major bug in the npm ecosystem that he recently disclosed. We cover the bug’s timeline, nuances, and impact, all while setting some important context on npm packages, clients, and registries. Tune in to learn how to protect your codebase and gain a deeper understanding of this crucial part of the JavaScript ecosystem. Join the discussion Changelog++ members save 2 minutes on this episode because they made the ads disappear. Join today! Sponsors: Fastly – Our bandwidth partner. Fastly powers fast, secure, and scalable digital experiences. Move beyond your content delivery network to their powerful edge cloud platform. Learn more at fastly.com Fly.io – The home of Changelog.com — Deploy your apps and databases close to your users. In minutes you can run your Ruby, Go, Node, Deno, Python, or Elixir app (and databases!) all over the world. No ops required. Learn more at fly.io/changelog and check out the speedrun in their docs. Typesense – Lightning fast, globally distributed Search-as-a-Service that runs in memory. You literally can’t get any faster! Changelog News – A podcast+newsletter combo that’s brief, entertaining & always on-point. Subscribe today. Featuring: Darcy Clarke – Website, GitHub, LinkedIn, Mastodon, X Amal Hussein – GitHub, X Feross Aboukhadijeh – Website, GitHub, X Show Notes: Darcy / vlt’s blog post on this massive npm bug Feross / Socket’s follow-up blog post in this issue Refactor Conf - Darcy & Feross will be speaking in July Verdaccio (not to be mistaken with Versace) - an open source npm registry proxy Github layoffs for engineering team in India Bug filled July 28th, 2022 related to binding.gyp and triaged on October 22nd, 2022 Darcy’s original test POC from Nov 2nd, 2022 Darcy’s POC from March 8th, 2023 which was used in the HackerOne report to Github Legacy docs for npm publish params Tool for checking packages for manifest mismatches Great resource for security acronyms Something missing or broken? PRs welcome!

Darcy Clarke

Co-founder

npmvltGitHub

Darcy Clarke joined the show to talk about his repo on the HTML5 Boilerplate org on GitHub “Front-end Developer Interview Questions”. We discussed why the repo has been so successful, the challenges of translating a text document into multiple languages, managing contributions, the art of interviewing, how the expectations of front-end developers have evolved over time, and how to stay relevant in our fast moving industry. Join the discussion Changelog++ members support our work, get closer to the metal, and make the ads disappear. Join today! Sponsors: Codeship – If it works with Docker, it works with Codeship Jet. Toptal – Join Toptal and work with awesome people from anywhere in the world. Freelance with companies like Airbnb, Artsy & IDEO. Code School – Learn to program by doing with hands-on courses. Sign up for Code School at only $19/month. That’s $10 off per month! Featuring: Darcy Clarke – Website, GitHub, LinkedIn, Mastodon, X Adam Stacoviak – Website, GitHub, LinkedIn, Mastodon, X Jerod Santo – Website, GitHub, LinkedIn, Mastodon, X Show Notes: Darcy is the creator of the Front-end Developer Interview Questions project on the H5BP org on GitHub – it’s “a list of helpful front-end related questions you can use to interview potential candidates, test yourself or completely ignore.” At the end of the episode, we turned the tables on Darcy and asked him a few questions from the list. “The goal is to try to have the (interview) question be more open ended, and hopefully it starts a discussion between the interviewer and interviewee.” - Darcy Clarke @ 12:28 “This document is like a high school english assignment, with over 100 group members, and they all have differing opinions, and there’s a ton of different subjects… It’s the worst kind of open source project.” - Darcy Clarke @ 22:56 h5bp/Front-end-Developer-Interview-Questions darcyclarke (Darcy Clarke) darcyclarke/DSS Front-end Job Interview Questions | Darcy Clarke What I learned interviewing with Google | Wes Bos Join us on The Changelog (today?) · Issue #258 · h5bp/Front-end-Developer-Interview-Questions How io.js built a 146 person, 27 language localization effort… in one day. — Medium auduno/clmtrackr The Changelog #67: HTML5 Boilerplate, Modernizr, and more with Paul Irish Flipboard/react-canvas Paul Irish Wes Bos Something missing or broken? PRs welcome!

Darcy Clarke

Co-founder

npmvltGitHub