3 ms·
I'm sorry if you were unaware, but they absolutely do that, and were doing that long before go was.
by dnautics 7y ago
I'm sorry if you were unaware, but they absolutely do that, and were doing that long before go was.
- sneak 7y agoI am aware of package lockfiles. If deps are immutable, then nothing anyone does in any other package (short of having the package repository take the code down) should be able to break your future builds. If that were true, TFA would not be news.
- dnautics 7y agoI'm not a node expert but i believe the problem is that most people auto-update their node dependencies (I know I do, but I only have to do it rather rarely, since I don't primarily use node), because there are just so often minor security regressions that need to be fixed.
- n_e 7y ago> If deps are immutable, then nothing anyone does in any other package (short of having the package repository take the code down) should be able to break your future builds. They are. You're only affected if you don't use a package-lock.json or start a new project (which will pull the latest versions of the dependencies).