Changelog

Copy Markdown View Source

0.6.0

0.5.3

  • Add NPM.PackageResolver.relative_import_path/3 — compute relative import paths between files within a project root, with guaranteed .//../ prefix

0.5.2

  • Add NPM.PackageResolver — Node.js module resolution algorithm (specifier parsing, node_modules traversal, package.json entry points, extension probing)
  • Fix ETS race condition in NPM.Resolver cache initialization
  • Fix NPM.Cache.ensure/5 spec and docs to include {:ok, :missing_optional} return
  • Fix dead code in NPM.PeerDeps version matching (redundant boolean case)
  • Fix NPM.FileSize.by_extension/1 dead || branch (Path.extname never returns nil)
  • Fix NPM.DepSort.install_order/1 dead {:error, :cycle} branch
  • Fix crash in NPM.Linker nested version resolution on unparseable versions
  • Replace blanket rescue _ with specific exception types across the codebase
  • Flatten nesting in expand_all_optional_deps, solver_dependencies, select_group
  • Bump ex_dna ~> 1.1 → ~> 1.3

0.5.1

  • Platform-agnostic lockfile: npm.lock now includes all optional platform bindings, not just the current platform
  • Only install matching platform bindings into node_modules at link time
  • Lockfiles are now portable across OS/arch — same as npm's package-lock.json behavior

0.5.0

0.4.6

  • Add packument disk cache (~/.npm_ex/packuments/) with 1h TTL — avoids refetching registry metadata on repeat installs
  • Skip resolution entirely when lockfile matches package.json and node_modules is intact

0.4.5

  • Switch default linker strategy from symlink to copy, fixing ESM module resolution for cached packages
  • Fix NodeRunner entrypoint resolution to follow bin symlinks correctly
  • Cache platform binding selection results, reducing resolve time from ~35s to ~1.5s for packages like oxfmt
  • Generalize platform binding family detection for both old-style (@oxfmt/darwin-arm64) and new-style (@oxfmt/binding-darwin-arm64) naming
  • Avoid grouping non-platform optional dependencies (e.g. @babel/core) as platform variants

0.4.4

  • Fix npm registry packument decoding for optional platform dependency inspection
  • Select the correct platform-specific optional binding for packages like oxfmt and oxlint
  • Keep mix npm.exec running binaries through Node instead of shell string spawning
  • Preserve optional_dependencies in npm.lock
  • Skip linking crashes when optional packages are unavailable

0.4.3

  • Fix mix npm.exec to resolve binaries via NPM.Exec.which/2 and run them through Node instead of shell string spawning
  • Preserve optional_dependencies in npm.lock
  • Skip linking missing optional packages instead of crashing during install
  • Add focused test coverage for exec environment, cached Node runner execution, optional runtime linking, and resolver optional dependency handling

0.4.2

  • Speculative parallel prefetch of transitive dependencies before solving — fetches the full dep tree breadth-first with 16 concurrent requests
  • Deduplicate format_size/format_bytes across 8 modules into NPM.Format.bytes/1

0.4.1

  • Fix mix tasks crashing with unknown registry: Req.Finch when host app hasn't started the HTTP stack

0.4.0

New Mix Tasks (21 new, 43 total)

Install UX

  • mix deps-style output after install — packages listed as * name version (npm registry)
  • Progress reporting for resolution, fetching, and linking steps
  • Structured error messages with actionable suggestions
  • Lockfile diff output showing added/removed/updated packages on install
  • Project setup checklist (NPM.ProjectInit)

Dependency Analysis (30+ modules)

Package Metadata (20+ modules)

Security & Supply Chain

Configuration

Infrastructure

Other

  • devDependencies support (--save-dev, --production)
  • optionalDependencies support (--save-optional)
  • --save-exact flag for pinning exact versions
  • node_modules/.bin/ executable linking
  • overrides support in package.json
  • Custom registry URL via NPM_REGISTRY env var
  • Auth token support via NPM_TOKEN env var
  • SHA-256 integrity verification (in addition to SHA-512 and SHA-1)
  • Retry with exponential backoff for failed HTTP requests
  • file: dependency references
  • 2,697 tests (up from 64)

0.3.1

0.3.0

  • mix npm.remove — remove a package from package.json
  • mix npm.list — show installed packages with versions
  • mix npm.install --frozen — fail if lockfile is stale (CI mode)
  • Fix scoped package parsing (@scope/pkg@^1.0 was splitting incorrectly)
  • Timing output for resolve and install steps
  • Rename install/2 to add/2 in the public API
  • Expand test suite to 64 tests

0.2.0

  • Global package cache at ~/.npm_ex/cache/ — download once, reuse across projects
  • node_modules/ linking via symlinks (unix) or copies (Windows)
  • Hoisted flat layout
  • Switch from :httpc to Req for HTTP
  • Add mix npm.get task
  • Add credo, ex_slop, ex_dna, dialyzer
  • Add unit and integration tests
  • Add GitHub Actions CI

0.1.0

Initial release.

  • mix npm.install — resolve and install all deps from package.json
  • mix npm.install <pkg> — add a package and install
  • PubGrub dependency resolution via hex_solver
  • npm registry client with abbreviated packuments
  • SHA-512 integrity verification
  • npm.lock lockfile for reproducible installs