DuckDB maintainer here, thanks for flagging this. Indeed the npm stats are delayed. We will know in a day or so what the actual count was. In the meantime, I've removed that statement.

I think you should unpublish rather than deprecate... `npm unpublish package@version` ... It's possible within 72h. One reason is that the patched version contains -alpha... so tools like npm-check-updates would keep the 1.3.3 as the latest release for those who installed it

Yes we tried, but npm would not let us because of "dependencies". We've reached out to them and are waiting for a response. In the meantime, we re-published the packages with newer versions so people won't accidentally install the compromised version.

At least one thing is clear from this week: npm is too slow to respond.

> npm is too slow to respond

Microsoft has been bravely saying "Security is top priority" since 2002 (https://www.cnet.com/tech/tech-industry/gates-security-is-to...) and every now and then reminds us that they put "security above all else" (latest in 2024: https://blogs.microsoft.com/blog/2024/05/03/prioritizing-sec...), yet things like this persists.

For how long time do Microsoft need to leave wide-open holes for the government to crack down on their wilful ignorance? Unless people go to jail, literally nothing will happen.

TIL that NPM is a subsidiary of GitHub, making this indeed Microsoft's responsibility.

they have now removed the affected versions!

SSH port forwarding?

It looks like the port is configurable, so that should make it easier to avoid conflicts but I wonder how the performance would be impacted.

I was able to get it working and it seemed fast enough. However I don't have any local databases of similar size to compare to.

ssh -F ssh.config -L 4213:localhost:4213 dev 'DUCKDB_HTTPPORT=4213 ~/.duckdb/cli/latest/duckdb -ui'

Yes we are working on it

Is there a roadmap on handling geographic data?

Yes! I'm working hard on it, I've been distracted with other work for some of our clients but hopefully have something to show soon.

It does, DuckDB supports recursive CTEs

DuckDB also works fine with R data frames so there is really no downside to using R in this case

DuckDB has its own Parquet reader

DuckDB can directly & selectively query Parquet files over HTTP/S3 as well. See here for examples: https://github.com/duckdb/duckdb/blob/6c7c9805fdf1604039ebed...

One of the DuckDB authors here. Can you open an issue wrt the import problem? Should not happen. Try setting a database file and a memory limit.

Yes, DuckDB has strict typing.

One of the DuckDB authors here. The answer is yes, but only in read-only mode at the same time.

What about one single client writing and multiple clients in read-only mode? Any problems with storing the file on network storage? Basically, how far can you push it before it is better to just use PostgreSQL?