3 ms·
This should affect people only if they're not using specific versions and not using package-lock.json. It's exactly what those features are meant to do, updatin
by politelemon 4y ago
This should affect people only if they're not using specific versions and not using package-lock.json. It's exactly what those features are meant to do, updating should be a deliberate action. It's really bad that it's affected production sites so the devs will hopefully make use of package lock.
- kevincox 4y agoThe sad fact is that the number of users who have good testing of their HTTP client is smaller than the number of people who have automatic dependency updates or would merge without successfully testing this. With unit testing it us generally considered bad practice to test your dependencies and many people don't have good integration tests.
- SahAssar 4y agoEither way people should not pull in new versions of dependencies and automatically deploy those to prod. One of the comments mentioned a app store review, which means that they pull in unpinned versions in a app that they cannot update by themselves. That is crazy.
- acdanger 4y agoTo be fair, the Axios docs also suggest using the hosted package as well which I assume would also lead to the same situation. https://github.com/axios/axios#installing https://github.com/axios/axios#installing