4 ms·
Assuming you audit what was locked, and audit whenever you update, then yes. I'd be worried a coworker would go on an update spree just because they can, and wo
by scintill76 9y ago
Assuming you audit what was locked, and audit whenever you update, then yes. I'd be worried a coworker would go on an update spree just because they can, and wouldn't audit the new code.
- ralusek 9y agoYes but then you're no longer grappling with the limitations of the ecosystem. Introducing a rogue developer who updates dependencies irresponsibly is a danger in any language.
- caspervonb 9y agoWho really audits every single dependency in their dependency tree? not so much a rogue developer, but most.
- xfer 9y agoIf you are hobby programming, then not really, but in most workplaces, dependencies are usually pinned and not updated until necessary(bug fixes mostly).
- caspervonb 9y agoFrom what I've seen as a contractor usually there is no package-lock at all.