4 ms·
I think the problem is that people (myself included) rarely update npm packages, and perhaps the upstream creators of some libraries won’t update either, mainly
by epmaybe 6y ago
I think the problem is that people (myself included) rarely update npm packages, and perhaps the upstream creators of some libraries won’t update either, mainly out of fear the update will break some part of your project.
- rwmj 6y agoSure, but there is a chance you will update them, whereas if you'd homebrewed the code or copied the code in, the bug would probably never be detected or fixed. And for those who do care about their packages and deps, they update in a timely manner.
- yjftsjthsd-h 6y agoJust stick a `npm audit` in your CI jobs to run weekly or so?