3 ms·
> but I would hope that such a poison-pill would be caught long before the package became widely depended on. I'm not sure what about the current open source e
by pc86 5y ago
> but I would hope that such a poison-pill would be caught long before the package became widely depended on.
I'm not sure what about the current open source ecosystem makes you think anyone would catch something like this.
- zdragnar 5y agoFunny, my company couldn't use Webpack 1 because a dependency of a dependency... depended on an ancient package from the days when it was common to not bother with attaching a license. Legally, that meant that noone could use it. In practice, nobody but our legal department cared, so we had to wait for version 2 when the dependency chain was updated to remove it.
- Dylan16807 5y agoYou couldn't override the package locally? Or was too much of that code actually needed?