Frankly, that document is a complete communication failure. It is pure nerdview written in nerdalese. Nobody whose mother hasn't come down in the server room can possibly understand what this document intends to communicate, or what to do about it, or even whether you have to do anything about it.
They helpfully points to the NPM documentation which apparently has been updated to reflect the newest changes BUT what they link to is literally https://docs.npmjs.com/ which—unsurprisingly—gets you to the NPM documentation front page. That page has two identical lists of such existing topics as "About npm", "Getting started", "Packages and modules", "Integrations", "Organizations", "Policies", "Threats and mitigations", "npm CLI", but apparently none that is specific to the policy change and "granular writable tokens" or whatever.
I'm completely lost. How do I test whether I have to change anything? If I have to change something, what data will be affected on my side and the remote side? What tools do I have to use, can I use a web address or should I use the npm (or pnpm) CLI tools? What will I have to do in the future? Will I have to go through the procedure every 30 days looking forward? What are the consequences if I miss a date, can I somehow revert?
None of these simple, obvious and important questions is apparently covered in any way by the pages that I was made to click through to. All I know now that have to worry about grainy write tokens.
bn-l•2mo ago
DemocracyFTW2•2mo ago