3 ms·
Isn't this mostly a problem of auto-updating and non-pinned dependencies? If you vendor and audit your dependencies this isn't really a problem.
by dewey 5y ago
Isn't this mostly a problem of auto-updating and non-pinned dependencies? If you vendor and audit your dependencies this isn't really a problem.
- mushyhammer 5y agoYes true but have you audited your thousands of modules? If you have a build tool that wasn’t born in 2020 chances are it pulls a hundred dependencies from 20 separate vendors. I saw this as a JS developer who scarily runs npm installs multiple times a day.