If you are depending on another persons package and haven't bothered to lock in a version or bundle the version into your application, your site is not your sit

If you are depending on another persons package and haven't bothered to lock in a version or bundle the version into your application, your site is not your site. If you want to depend on other's peoples work without taking care to insulate yourself, you'll have to deal with it. Why is it none of my applications were affected by `left-pad` this week? Good question. NPM had plenty of chances for realistic ( non-venture capital based ) funding. They took too much cash and hired too many people. Now everything is starting to fall apart.