3 ms·
This is easily fixable by using tooling to help review. For example I have high hopes in the crev project: https://github.com/crev-dev/crev https://github.com/c
by remram 5y ago
This is easily fixable by using tooling to help review. For example I have high hopes in the crev project: https://github.com/crev-dev/crev https://github.com/crev-dev/crev
As soon as you are no longer implicitly trusting all future versions of your dependencies, things become much more sane.
- Zababa 5y ago> As soon as you are no longer implicitly trusting all future versions of your dependencies, things become much more sane. I agree, I wish npm ci and fixed dependencies were the default, but they're not and people need to learn about them.
- remram 5y agoLock files are not enough, you can't review all the dependencies yourself every time you lock. A new tool is needed to deal with trust.