acuvo-code 0.6.6 → 0.6.7
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/lib/self-update.mjs +17 -1
- package/package.json +1 -1
package/lib/self-update.mjs
CHANGED
|
@@ -170,7 +170,23 @@ export function applyUpdate({ spawn, version = 'latest' } = {}) {
|
|
|
170
170
|
try {
|
|
171
171
|
const child = spawn(
|
|
172
172
|
process.platform === 'win32' ? 'npm.cmd' : 'npm',
|
|
173
|
-
|
|
173
|
+
/**
|
|
174
|
+
* ⚠️⚠️ `--prefer-online`, AND IT IS NOT BELT-AND-BRACES. npm caches the
|
|
175
|
+
* PACKUMENT — the document listing a package's versions and which one is
|
|
176
|
+
* "latest" — and serves it without revalidating. Reproduced here
|
|
177
|
+
* 2026-08-22, minutes after publishing 0.6.6:
|
|
178
|
+
*
|
|
179
|
+
* npm view acuvo-code version -> 0.6.6
|
|
180
|
+
* npm i -g acuvo-code@latest -> installed 0.6.5
|
|
181
|
+
* npm i -g acuvo-code@latest --prefer-online -> installed 0.6.6
|
|
182
|
+
*
|
|
183
|
+
* So a SECOND staleness layer sits underneath the one that caused this
|
|
184
|
+
* whole incident, and it would have made the updater report success
|
|
185
|
+
* while installing the version the user already had. An update mechanism
|
|
186
|
+
* that silently no-ops is indistinguishable from the bug it was written
|
|
187
|
+
* to fix.
|
|
188
|
+
*/
|
|
189
|
+
['install', '-g', '--prefer-online', `${PACKAGE_NAME}@${version}`],
|
|
174
190
|
{ stdio: 'ignore', detached: true },
|
|
175
191
|
);
|
|
176
192
|
child.unref?.();
|