v2.0.1 did not properly release on npm

[acalcutt]

In #905 we tried to release v2.0.1, but it seems to have failed due to the NPM_TOKEN stored in the repo being expired, since the same error happened the last time we made a release in #888 (comment) and that token had expired then.

We discussed who can update this, but it doesn't sounds like anyone has permission to do this.. In the past @mapsam suggested @bilindhajer could help last time, but I am not sure that is still true. (if either of you have any suggestions that would be helpful)

In #905 (comment) I did offer to become a maintainer, so if someone wanted to give my npm account 'acalcutt' access to make a release, maybe I could help get that key updated. I have been making my own release at npm and git and would love to move away from having my own release.

[acalcutt]

Any ideas on how we can get this npm package published? I did publish it to @acalcutt/node-pre-gyp v2.0.1 but i was hoping not to move back to my release.

[robcresswell]

@acalcutt Is there someone we can contact here? This library is really widely used, and its kinda concerning that its been unable to publish for ~6 months.

Should I try and nudge someone at mapbox somehow? via linkedin? 😅

[acalcutt]

I wasn't able to find anyone who could help. We need someone from mapbox to update the NPM_TOKEN in this repo with one that can publish, but it doesn't seem like there is anyone around with that access.

I had to move maplibre-native back to @acalcutt/node-pre-gyp v2.0.1 so i could publish for the latest node.

[robcresswell]

🤦🏻‍♂️ 8 mil downloads a week and nobody can update it

[cclauss]

Business model: 8m * $0 == $0

[robcresswell]

I'm more concerned about the security implementations. If this gets compromised, or an issue is discovered, the blast radius is massive.

🤷🏻