2

I'm interested in introducing a GitHub project into our enterprise org. That GitHub project currently offers the tool in both Managed Package and Unlocked Package format. The Unlocked Package format has no namespace.

I'm trying to weigh the pros and cons between forking this project and creating my own Unlocked Package version of it, or just installing the version being maintained by the creator. I'm set on using the Unlocked Package because it offers some options that aren't available in the Managed Package (I guess due to limitations on Managed Package code)

Questions:

I see that as of Winter '21, upgrades can now be pushed to subscribers automatically, is there any way we can turn this off? https://help.salesforce.com/s/articleView?id=release-notes.rn_sfdx_packaging_push_upgrade_2GP.htm&type=5&release=228

Also - are there any other benefits that I'm not thinking of, other than receiving fast updates and not needing to maintain and update my own fork?

1 Answer 1

2

You can't disable the automatic push feature; it's the same feature that ISVs have had available for years. Publishers tend to take this responsibly seriously though, because if they screw up, it could damage their reputation and potentially have legal consequences.

That said, this all involves a certain level of trust. If you don't trust the publisher to do the right thing, don't use their Unlocked Package. If you do trust them, and you use the package, you will be assuming a certain level of risk. It's up to you (and your IT/Security team, etc) to determine if the benefits are worth the risks.

Personally, I would take advantage of an Unlocked Package if I trusted the publisher and didn't want to maintain my own repository just for kicks. After all, we all have only so much time to do our work, so anything that makes it easier for us should be considered as an viable alternative.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .