8 ms·
"I think the real fix is that dependency management tools like NPM and Maven need to make it much easier to "override" dependency package names so that, if a cr
by j-bos 5y ago
"I think the real fix is that dependency management tools like NPM and Maven need to make it much easier to "override" dependency package names so that, if a critical issue is discovered, you are not at the mercy of the current maintainers of that package to quickly get a fix into production."
I'm probably mistaken, but I thought in maven managedDependencies was exactly this. Please correct me if I'm wrong.
- ohgodplsno 5y agoMaven/Gradle does exactly that. Provided the dependency you're replacing is compatible with the new one (same packages, same methods, etc), it's fully transparent. It's just that once again, the web world is running with awful tools that keep making the same mistakes that have been done years before them.
- CRConrad 5y agoUpvoted for that last sentence.