3 ms·
I think NPM should store packages in predicable paths and not move them around. That way you can have your dependencies in source control and review all depende
by z3t4 8y ago
I think NPM should store packages in predicable paths and not move them around. That way you can have your dependencies in source control and review all dependency updates. This worked great for me before npm started doing tree shaking. You can lock down the packages to semver minor and you will only get minor updates. Detecting something like an encrypted blob is pretty easy when you review a commit.
- specialist 8y agoAssuming you mean ./node_modules/[org]/[module]/[semver] This is the correct answer. I'm okay with using aliases (links) which resolve to preferred semver. Much like nvm does for nodejs runtimes.
- kevinsimper 8y agoYes, that could also be a good solution! Even with tree shaking you could still review it and encrypted blobs would be a great thing to look out for!