5 ms·
Shouldn't the main concern highlighted here already be taken care of with package-lock.json and yarn.lock? They record the dependency trees, so a rogue package
by politelemon 9y ago
Shouldn't the main concern highlighted here already be taken care of with package-lock.json and yarn.lock? They record the dependency trees, so a rogue package update should not really affect you.
- scintill76 9y agoAssuming you audit what was locked, and audit whenever you update, then yes. I'd be worried a coworker would go on an update spree just because they can, and wouldn't audit the new code.
- ralusek 9y agoYes but then you're no longer grappling with the limitations of the ecosystem. Introducing a rogue developer who updates dependencies irresponsibly is a danger in any language.
- caspervonb 9y agoWho really audits every single dependency in their dependency tree? not so much a rogue developer, but most.
- xfer 9y agoIf you are hobby programming, then not really, but in most workplaces, dependencies are usually pinned and not updated until necessary(bug fixes mostly).
- caspervonb 9y agoFrom what I've seen as a contractor usually there is no package-lock at all.