3 ms·
Discussion from last week where dependabot was proposed as a solution to the issue of third party contributors sneaking exploits into package-lock changes: http
by jakear 7y ago
Discussion from last week where dependabot was proposed as a solution to the issue of third party contributors sneaking exploits into package-lock changes: https://news.ycombinator.com/item?id=21886914 https://news.ycombinator.com/item?id=21886914
My stance is still "if there's no CVE, and your application works, why go around introducing changes to the environment you're running it in?"
- palijer 7y agoDoing gradual smaller changes over time and reducing the delta removes the risk of having to update everything at once down the road. We use dependabot to prevent our services from becoming the legacy issues that no one wants to touch. We'd rather fix small issues continuously than have giant overhauls when a bunch of packages need to get updated because we weren't staying on top of it. I think about it like a CD pipeline for dep updates. Less risk if you ship smaller amounts of code.