3 ms·
I really enjoy using Composer as well but my exposure is limited. Does composer do anything for security that npm fails at? The most I've seen is that packages
by flanbiscuit 8y ago
I really enjoy using Composer as well but my exposure is limited. Does composer do anything for security that npm fails at? The most I've seen is that packages in composer tend to have way less dependencies than npm packages but that's not really a great reason to call it more secure (better, yes, but not ideal). Just wondering if Composer has some security features that I'm not aware of.
- MattyRad 8y agoI'm not aware of any security advantages compared to npm. But one thing that comes to mind is that a while ago npm, by default, did not generate lock files, which is very much a risk concerning deployment and dependency-management in general. It's not an issue any longer, though, both yarn (yarn.lock) and npm (package-lock.json?) generate lock files by default.