4 ms·
I wonder if Yarn can do anything more to solve these problems from a CLI tool perspective. Stricter version locking? Better alerts for compromised dependencies?
by sebmellen 5y ago
I wonder if Yarn can do anything more to solve these problems from a CLI tool perspective. Stricter version locking? Better alerts for compromised dependencies?
- nathanaldensr 5y agoYarn and NPM are enablers of these issues, not solutions to them. The convenience they afford combined with the culture of the JavaScript package ecosystem needs to be entirely revisited. As it stands, we are all simply waiting for something widescale and truly serious to happen from one of these incidents. Then--and only then, it seems--will mature perspectives be called for.