3 ms·
When one of the transitive dependencies fixes a security issue, is it then re-evaluated prior to being updated in the internal repo? I'm guessing you work at a
by jfoster 6y ago
When one of the transitive dependencies fixes a security issue, is it then re-evaluated prior to being updated in the internal repo?
I'm guessing you work at a pretty large tech company. It seems wasteful that so many companies might be replicating this work. I wonder if there might be the opportunity for a body to review & approve packages on behalf of many companies. Perhaps npm will eventually move in this direction.
- carapace 6y ago> When one of the transitive dependencies fixes a security issue, is it then re-evaluated prior to being updated in the internal repo? Yes, but this is typically pretty low overhead. And when it's not, it usually means there is some issue that has to be addressed anyway. > I'm guessing you work at a pretty large tech company. I did once, but right now "we" is a tiny startup (we're using Elm and Erlang.) > I wonder if there might be the opportunity for a body to review & approve packages on behalf of many companies. Ideally, that's what Free/Open Source Software would be, eh? In the old days there were "sysadmins", System Administrators, who handled a lot of this sort of thing.