6 ms·
Because it's one line to a dependency with a name, a documentation, a bug tracker, many users, and that could be improved in the future. If you are scared abou
by speedgoose 6y ago
Because it's one line to a dependency with a name, a documentation, a bug tracker, many users, and that could be improved in the future.
If you are scared about packages behaving differently, you should know that npm has lock files that describes your full dependency tree with versions and checksums.
- majormajor 6y ago"Could be improved in the future" is a risk when it comes to a simple utility function that does a simple thing that you don't want to change. In the same way that someone constantly tweaking your utility functions in your own project would be a risk - and you'd understandably want to code review all that - the more you choose to (or have to) outsource "trivial" stuff, the more brittle your project is.
- ioseph 6y agoHence the lockfile, on the flipside if you've copy and pasted source across which contains a security update you'll most likely not realise