3 ms·
How to avoid such kind of problems? node_modules is terrible. I can only think of some ideas: - Use a private registry, which will only sync with upstream onc
by ammo1662 5y ago
How to avoid such kind of problems? node_modules is terrible.
I can only think of some ideas:
- Use a private registry, which will only sync with upstream once a month.
- Do not update dependencies frequently.
Any other ideas?
- PHGamer 5y agospecify specific versions in your npm or pip package list lol.
- mindwok 5y agoEven better, specify by hash - Poetry for Python does this by default. This will prevent cases where malicious actors replace existing versions that you might have pinned to.
- ammo1662 5y agoYes, package.lock is used by default now. But when you do want to update the dependencies. It will update thousands of libraries at the same time. However it is a problem of the eco system, not package manager.