3 ms·
In times of security fixes sometimes there is only one secure version but the whole ecosystem is built around the fact that older, flawed version can still be i
by blablabla123 7y ago
In times of security fixes sometimes there is only one secure version but the whole ecosystem is built around the fact that older, flawed version can still be included. Another drawback is performance, npm install is amazingly slow. In fact package resolution is NP-complete: https://research.swtch.com/version-sat https://research.swtch.com/version-sat
I generally agree but the problem is even worse :)
- JMTQp8lwXL 7y agoYarn is a bit more sophisticated and has a concept of "resolutions" which would be great for the security use case of forcing a particular version. Even if B and C need different major versions, say D@v1-with-security-fix and D@v2-with-security fix, yarn supports that too, since resolutions can be nested. https://yarnpkg.com/lang/en/docs/selective-version-resolutions/ https://yarnpkg.com/lang/en/docs/selective-version-resolutio...