5 ms·
So... set ourselves up for another Log4j situation where a vulnerability is found in a sub-sub-sub dependency of some dependency you didn't even know you were u
by creatonez 4y ago
So... set ourselves up for another Log4j situation where a vulnerability is found in a sub-sub-sub dependency of some dependency you didn't even know you were using, such that only good way of fixing it is to manually scrub the code from `.jar`s?
- davidmurdoch 4y agoOr wait a few days for a patch to be released.
- creatonez 4y agoWait a few days for what, exactly? For your sub-sub-sub dependency to patch it, then for your sub-sub dependency to notice this and update the version, then for your sub-dependency to notice it to update it, then for your dependency to finally notice and update it? The solution that npm presents solves this problem without this insanity -- you can just create a `npm-shrinkwrap.json` file to manually update sub-dependencies. If one of your dependencies used bundling, this solution becomes impossible.
- moltar 4y agoIn NPM 8 you can override sub deps quite effectively, even using references. Another option is package-patch. Very light, elegant and yet robust solution for fixing anything in any package you depend on yourself without waiting for maintainer to fix it.