3 ms·
Yes but then you're no longer grappling with the limitations of the ecosystem. Introducing a rogue developer who updates dependencies irresponsibly is a danger
by ralusek 9y ago
Yes but then you're no longer grappling with the limitations of the ecosystem. Introducing a rogue developer who updates dependencies irresponsibly is a danger in any language.
- caspervonb 9y agoWho really audits every single dependency in their dependency tree? not so much a rogue developer, but most.
- xfer 9y agoIf you are hobby programming, then not really, but in most workplaces, dependencies are usually pinned and not updated until necessary(bug fixes mostly).
- caspervonb 9y agoFrom what I've seen as a contractor usually there is no package-lock at all.