3 ms·
So the challenge even for someone like MS is, how far down the line do they go. Do they do a one-time review, problem there is it won't catch new issues. Do t
by raesene9 6y ago
So the challenge even for someone like MS is, how far down the line do they go.
Do they do a one-time review, problem there is it won't catch new issues.
Do they provide PRs for fixing issues found, that's another level of complexity.
If the library owners don't patch promptly, do MS fork the lib, if they do, will people move to their forked version?
It's a complex area to say the least :)
It'd be great to see more companies take it on but I have a feeling it'll be a long time before we see significant coverage of this kind of issue.
- jakelazaroff 6y agoIn this case, a one-time review might have sufficed; this bugfix was the first release in five years. But generally speaking, you're 100% right — and obviously, this little package is orders of magnitude less complex than e.g. React or Express.