3 ms·
> we are running several dependencies in production > automatically pull future commits You are very trustful. Those two are a big no-no. Dependencies should
by pestatije 6y ago
> we are running several dependencies in production
> automatically pull future commits
You are very trustful. Those two are a big no-no. Dependencies should be curated.
- verdverm 6y agoyes, security and malicious updates on hacked repos is another concern
- gervwyk 6y agoYes. Of course curating dependencies is super important. What I meant by automatically pull future commits is to keep the clone updated. I’m concerned about future maintainability should the main repo be removed from GitHub for whatever reason. From a security perspective we go into all details before introducing a dependency and track changes on future version - this is also currently a very manual process, not sure how this could be done better aswell.