2 ms·
The "magical security updates" theory has never worked. Breaking insufficiently-pinned dependencies are vastly more common than unnoticed fixes on patch release
by jessaustin 7y ago
The "magical security updates" theory has never worked. Breaking insufficiently-pinned dependencies are vastly more common than unnoticed fixes on patch releases. On balance, semver has been good for javascript, but to the extent it contributed to the popularization of this dumb theory it has been bad. Production apps (and by a transitive relation, one supposes, library modules) should be zealously pinned to the fewest possible dependencies, and those dependencies should be regularly monitored for updates. When those updates occur, tests can be run before updating the pins.
- stagas 7y agoRight, making significant changes to the entry points of a library should be marked as a breaking change and bump the major version.
- montroser 7y agoYes -- pinning dependency versions does not have to be at odds with security. In fact, how secure is it, really, to keep dependencies unpinned and welcome literally /any/ random upstream code into your project, unchecked? This is yet more irresponsible than letting dependencies age. But even then, it's not as if you have to choose -- you can pin, then vet upstream updates when they come, and pin again.