Vlt 1.0 and Hosted Package Registries
49 points by patrikcsak 6 hours ago | 15 comments
nerdalytics 5 hours ago
Over a year I joined the waitlist and almost forgot that I did. Today the registry is open to deliver on its promises—secure the supply chain.
reply
10s: vlt helps engineering teams build JavaScript software faster, reduce supply chain risk, and lower infrastructure costs (via. API perf / payload optimizations).
20s: If you've used npm for years & are just narrowly escaping the various malware attacks or are on the hook for running up CI/agent bills at work because cold installs are X percent of the time compared to your actual builds/runtime, then you should check us out.
22s: Also, <insert jFrog grumble>.
The team that was able to ship the most important features for npm to be competitive in the modern JS stack from ~2020 was able to take a fresh look at the problem without the organizational baggage of Github/Microsoft.
On the technical side, the ecosystem is maturing and we need a better set of foundational tools to meet that maturity level. This includes deep commitment to performance, security, and DX. The full product is more than just a package manager, it is a registry, a registry client, a task runner, and much more. Vlt is aiming to be this mature foundation.
Feel free to correct me if I am wrong on anything here Darcy.
P.S. grumble grumble...jFrog is a trash fire....grumble grumble
We've got more improvements coming soon but we're a roughly ~10-40% faster registry then npm out-of-the-box. Compared to incumbent enterprise registries we're like ~3x.