4 ms·
> transitive dependencies are automatically updated to pick up security fixes Does Node do this? That seems like an awful idea. People should be manually updat
by svnpenn 5y ago
> transitive dependencies are automatically updated to pick up security fixes
Does Node do this? That seems like an awful idea. People should be manually updating dependencies, never automatically. Stuff like dependabot need to die.
- coder543 5y agoDependabot gives you an easy way to review every single commit that went into a dependency update before you merge it. Dependabot is by far the most convenient way that I’ve seen to actually check that your dependency updates are not overtly malicious. It's not some tool that just removes your lockfiles behind your back, as you seem to be implying.