3 ms·

You don't have to always pull the latest release on utility packages if you want to evade such problems. Sure, you would need to audit a lot of packages in cert

You don't have to always pull the latest release on utility packages if you want to evade such problems. Sure, you would need to audit a lot of packages in certain languages... But yes, I prefer to "vendor" my dependencies too, especially on large projects.

lrvick 5y ago
Security vulns are fixed daily in most webapp dependency trees. If you do not update you are vulnerable to piles of issues anyone can look up. If you update blindly you may import new obvious supply chain attacks. The solution is actually doing code review. If you can not afford to review 2000 dependencies then you can not afford 2000 dependencies. The extra effort to use a minimal framework and some cherry picked functions may be worth it for most orgs.