3 ms·
That's why you lock your dependencies.
by choward 8y ago
That's why you lock your dependencies.
- dmortin 8y agoDependencies need bugfixes and you may even want to use new features, so locking is not a permanent solution.
- twodave 8y agoIf you're on point enough to know which features/bugfixes you're getting then you're probably doing enough to be safe already. Just don't go around running npm -u for no reason and you should be fine. The only way to be truly safe from this attack vector is to own all of your dependencies, and nobody is willing to do that so we're all assuming some amount of risk.
- cellis 8y agoThat will work assuming have have audited the code already, but you will also have to audit every (changed dependency)(factorial) every time you bump a dependency!
- sroussey 8y agoHope you don’t start your project with the compromised version — and then lock it in.